This page is for providers under investigation, and for the people who run their practices. If you are a beneficiary who wants to report suspected fraud, this is not the page you need — contact the HHS-OIG hotline or 1-800-MEDICARE directly. Everything below is written for the accused.
The most urgent practical fact about a Medicaid fraud investigation is this: your payments can stop before you are charged with anything. Under 42 C.F.R. § 455.23, a State Medicaid agency “must suspend all Medicaid payments to a provider after the agency determines there is a credible allegation of fraud for which an investigation is pending,” unless good cause exists not to. No indictment. No civil complaint. No hearing first.
For a practice that depends on Medicaid receipts, that is an existential event on a two-week timescale, and it has to be answered immediately — which means understanding the regulation rather than reacting to it.
The two programs, and who enforces them
| Medicare | Medicaid | |
|---|---|---|
| Funded by | Federal government | Federal and state jointly |
| Administered by | CMS, through Medicare Administrative Contractors | State agencies, under federal rules |
| Criminal enforcement | DOJ — the Health Care Fraud Unit and its Strike Force teams — with HHS-OIG and the FBI | Often a state Medicaid Fraud Control Unit (MFCU), and/or federal prosecutors |
| Civil enforcement | DOJ Civil Division and the U.S. Attorney’s Office, under the False Claims Act | Federal FCA and state false claims acts |
| Payment suspension | CMS suspension authority | 42 C.F.R. § 455.23 — mandatory on a credible allegation of fraud |
| Administrative sanction | HHS-OIG exclusion, 42 U.S.C. § 1320a-7 | HHS-OIG exclusion, plus state program termination |
Table: Medicare and Medicaid are different programs with different enforcers. A provider participating in both can face parallel investigations by different agencies on the same billing.
That distinction is not academic. A Medicaid Fraud Control Unit is a state law-enforcement body with its own investigators and its own prosecutors, operating under state law. A provider can be under investigation by an MFCU and by a federal Strike Force at the same time, with different rules, different charging authorities, and no obligation on either to coordinate for the provider’s convenience.
Payment suspension under 42 C.F.R. § 455.23
This is the regulation to read before anything else, because it is the one that reaches the practice first.
The rule
“The State Medicaid agency must suspend all Medicaid payments to a provider after the agency determines there is a credible allegation of fraud for which an investigation is pending under the Medicaid program against an individual or entity unless the agency has good cause to not suspend payments or to suspend payment only in part.”
Two things about that sentence. The suspension is mandatory on the stated trigger — the agency has no discretion once it makes the determination. And the escape valve is good cause, which is enumerated in the regulation and which the provider can argue for.
The notice, and the delay
“The State agency must send notice of its suspension of program payments within the following timeframes: (i) Five days of taking such action unless requested in writing by a law enforcement agency to temporarily withhold such notice. (ii) Thirty days if requested by law enforcement in writing to delay sending such notice, which request for delay may be renewed in writing up to twice and in no event may exceed 90 days.”
So a provider may see the money stop and receive nothing explaining it for up to three months — because law enforcement asked for the delay in order to protect an investigation the provider does not know about.
What the notice must contain
The regulation requires that it:
- state that payments are being suspended under this provision;
- “[s]et forth the general allegations as to the nature of the suspension action, but need not disclose any specific information concerning an ongoing investigation”;
- state that the suspension is temporary and cite the circumstances under which it will terminate;
- specify, where applicable, which types of claims or business units are affected;
- inform the provider of the right to submit written evidence for consideration by the State Medicaid Agency; and
- set out the applicable state administrative appeals process with citations.
That fifth item is the opening. It is a right conferred by the regulation, and exercising it well is the single most productive early step available.
Good cause not to suspend
The regulation lists six grounds on which a State “may find that good cause exists not to suspend payments, or not to continue a payment suspension previously imposed”:
- Law enforcement has “specifically requested that a payment suspension not be imposed because such a payment suspension may compromise or jeopardize an investigation”;
- “Other available remedies implemented by the State more effectively or quickly protect Medicaid funds”;
- The State determines, “based upon the submission of written evidence by the individual or entity that is the subject of the payment suspension, that the suspension should be removed”;
- Beneficiary access would be jeopardized because the provider “is the sole community physician or the sole source of essential specialized services in a community,” or “serves a large number of beneficiaries within a HRSA-designated medically underserved area”;
- “Law enforcement declines to certify that a matter continues to be under investigation”;
- “The State determines that payment suspension is not in the best interests of the Medicaid program.”
Good cause to suspend only in part
A parallel list permits partial suspension, or conversion of a full suspension to a partial one. The most useful ground is the third: where “[t]he credible allegation focuses solely and definitively on only a specific type of claim or arises from only a specific business unit of a provider,” and the State “determines and documents in writing that a payment suspension in part would effectively ensure that potentially fraudulent claims were not continuing to be paid.”
That is the argument for a practice whose alleged problem is one service line: suspend the claims at issue, not the whole practice. It requires showing the allegation is genuinely confined, which requires knowing what the allegation is — which is why the “general allegations” element of the notice matters, and why pressing for it is worth doing.
Practical sequence. Written evidence under paragraph (e)(3), a beneficiary-access showing under paragraph (e)(4) where the facts support it, a partial-suspension argument where the allegation is confined, and the state administrative appeal identified in the notice — pursued in parallel, not in sequence, because the practice’s cash position will not wait.
On this page
How the government builds a provider case
The evidence is assembled from sources the provider does not control, and most of it exists before anyone is contacted.
Claims data. Every claim submitted is a permanent structured record — beneficiary, date, code, rendering NPI, referring provider, amount billed, amount paid. The government holds all of it and can sort it any way it chooses. Nothing about the billing data is in dispute; only what it means.
Peer benchmarking. The same data supports comparison against every provider in the specialty and region. Outlier status is what generates the file, and it is also what produces the charts a jury sees. Outlier status has innocent explanations — a sicker panel, a subspecialty focus, a practice that absorbed another, a documentation habit — and the time to develop that explanation is before it is demanded.
Medical records. Subpoenaed from the practice, and frequently also from hospitals, imaging centers and pharmacies independently, which means the government may hold records the practice has never reviewed. EHR audit logs come with them: who opened a record, when, and what changed. This is why post-notice edits are always found, and why they are so damaging.
Former employees. Billing staff, coders, medical assistants, practice managers. Some are relators; some are simply people who left. Their account of “how things were done here” is frequently the intent evidence in the case.
Beneficiary interviews. Patients are asked whether a service occurred. Recollections are years old and imprecise, which is a fair subject of cross-examination but is persuasive when it aligns with the data.
The practice’s own compliance file. Audits, coding reviews, hotline reports, consultant memoranda. This material cuts unusually hard in both directions: a review that flagged a problem which was not fixed is the government’s best exhibit; one that considered the question and reached a defensible answer is the defense’s.
The 60-day overpayment rule, and how a refund becomes an FCA case
This is the trap that catches careful providers, and it operates automatically.
42 U.S.C. § 1320a-7k(d) provides that a person who “has received an overpayment” must “report and return the overpayment to the Secretary, the State, an intermediary, a carrier, or a contractor, as appropriate, at the correct address,” and must “notify [them] in writing of the reason for the overpayment.”
The deadline. “An overpayment must be reported and returned … by the later of — (A) the date which is 60 days after the date on which the overpayment was identified; or (B) the date any corresponding cost report is due, if applicable.”
The definition. An “overpayment” is “any funds that a person receives or retains under subchapter XVIII or XIX to which the person, after applicable reconciliation, is not entitled.” “Person” covers providers of services, suppliers, Medicaid managed care organizations, Medicare Advantage organizations and PDP sponsors — and expressly excludes beneficiaries.
The enforcement mechanism. “Any overpayment retained by a person after the deadline for reporting and returning the overpayment … is an obligation (as defined in section 3729(b)(3) of title 31) for purposes of section 3729 of such title.”
That converts the retained money into a reverse false claim under the False Claims Act — knowingly concealing or improperly avoiding an obligation to pay the government — with treble damages and per-claim penalties attached. A billing error worth a modest refund becomes an FCA case measured in multiples of it.
Three consequences follow, and they are the reason this needs handling by counsel rather than by the billing department.
The clock starts on “identified,” not on “quantified.” The statute does not define identification, and the point at which a provider is taken to have identified an overpayment — as opposed to having a credible indication that one may exist — is contested. What is clear is that indefinite investigation is not a safe answer: a reasonably diligent inquiry, promptly begun, is the posture that preserves the argument.
A refund is an admission of the amount refunded. It fixes a figure and a period, and it can be characterized as an acknowledgment of the underlying error. That is not a reason to fail to comply. It is a reason to be careful about scope, framing and accompanying explanation.
Retention is also a Civil Monetary Penalties Law violation. Under 42 U.S.C. § 1320a-7a(a), a person who “knows of an overpayment … and does not report and return the overpayment in accordance with such section” is subject to administrative penalties and assessments in addition to FCA exposure.
The billing theories, in terms a practice recognizes
Every Medicare and Medicaid fraud case is an allegation about claims. Six recur, and it is worth being precise about what each actually asserts.
Billing for services not rendered. The claim says a service occurred and the government says it did not. The medical record decides it, and where the record is thin the dispute becomes one about documentation practice rather than about occurrence.
Upcoding. A higher-level evaluation and management code, or a more complex procedure code, than the documentation supports. This is where the government’s data-analytics screen most often points, because E/M distribution is easy to benchmark. It is also the theory most likely to be a documentation problem rather than a fraud: physicians who do the work and record it thinly are common, and the difference between under-documenting and over-billing is exactly what an independent coding review establishes. Note that the Civil Monetary Penalties Law reaches a “pattern or practice” of upcoding specifically — 42 U.S.C. § 1320a-7a(a)(1)(A).
Medically unnecessary services. The service happened; the government says it was not needed. This is the theory on which physician defendants have the most substantive ground, because medical necessity is a prospective clinical judgment made on incomplete information and reasonable practitioners differ. The defense is expert and contemporaneous: what a reasonable practitioner would have done knowing what this practitioner knew at the time.
Unbundling. Separately billing components of a service that should have been billed under a single comprehensive code. Usually a coding-rules dispute, and frequently a software configuration issue rather than a decision anyone made.
Kickback-tainted claims. Any financial relationship with a referral source. Because 42 U.S.C. § 1320a-7b(g) provides that “a claim that includes items or services resulting from a violation of this section constitutes a false or fraudulent claim” under the FCA, a single arrangement can taint years of otherwise unremarkable billing. The analysis is on our stark law attorney page.
Telehealth, DME and laboratory arrangements. Marketing platforms that generate patient contacts, route them to a physician for an order, and bill durable medical equipment, genetic testing or laboratory services on the resulting orders. These are the highest-volume prosecutions currently brought. The physicians charged are frequently people who signed orders in volume for a per-order fee, and the contested question is what they understood about the platform’s economics rather than whether the billing codes were right.
How an audit becomes an investigation
Most criminal health care fraud cases do not begin as criminal cases. They begin as payment review, and the transition is not announced.
The review layers. Medicare payment integrity runs through contractors: Medicare Administrative Contractors performing routine claim review and targeted probe-and-educate; Unified Program Integrity Contractors conducting fraud-focused review across Medicare and Medicaid; Recovery Audit Contractors identifying improper payments on a contingency basis; and, on the Medicaid side, state program-integrity units and the MFCU.
The transition point. A contractor that develops an indication of fraud refers the matter rather than resolving it administratively. From the provider’s side the visible signs are indirect and easy to misread: a review that broadens without explanation, requests for records well outside the original sample or period, a request for records relating to specific referral sources or specific employees, an unexplained pause in correspondence, or a payment suspension.
Why the distinction matters immediately. In an administrative audit, the sensible response is to explain the billing and produce the documentation. Once a matter has been referred, the same instinct produces a statement to the government made without knowing what the government has. The transition is precisely the point at which the response strategy has to change, and it is not signposted.
The practical implication. Any audit that is unusual in scope, focus or duration should be assessed for criminal exposure before the next production goes out, not after.
The appeal ladder, and why it matters to a fraud case
Where the government’s position is an overpayment demand, there is an administrative appeals structure, and using it well does more than recover money — it builds a record.
42 C.F.R. § 405.904 sets out the sequence for Part A and Part B claims:
- Initial determination — “[t]he Medicare contractor makes an initial determination when a claim for Medicare benefits under Part A or Part B is submitted.”
- Redetermination by the contractor.
- Reconsideration — “the Qualified Independent Contractor (QIC) will perform[] a reconsideration of the claim.”
- A hearing before an Administrative Law Judge.
- Council review — review “by the Council” of the ALJ’s or attorney adjudicator’s decision.
- Federal district court, “if the amount remaining in controversy and the other requirements for judicial review are met.”
Two reasons this matters beyond the money.
It creates a record. Findings favorable to the provider at the ALJ level — on medical necessity, on documentation sufficiency, on the reasonableness of a coding position — are made by a neutral adjudicator on the same facts a prosecutor is examining. That is useful material.
It surfaces the government’s theory early, in a forum where the stakes are financial rather than penal, and where the provider can test the contractor’s methodology and error determinations before they harden into a criminal loss calculation.
The countervailing point is real and has to be weighed: submissions in the appeal are the provider’s own statements, and they are available. Where criminal exposure is live, what goes into an appeal needs the same care as anything else.
Extrapolation: where a small sample becomes a large number
A great many of these cases begin with an audit of a sample of claims and end with a demand covering a universe of them. The mechanism is statistical extrapolation: an error rate found in a sample is applied to the total population of claims in a period.
Extrapolation is permitted, but it is a methodology, and methodologies can be wrong. The recurring challenges are to:
- the sampling frame — whether the universe of claims was correctly defined, and whether claims that should have been excluded were included;
- the sample size and design — whether the sample was large enough and properly stratified to support inference at the stated confidence level;
- the error determinations within the sample — every claim classified as an error is itself contestable, and a sample-level error rate that falls materially on review scales down across the whole extrapolation;
- the confidence interval used — whether the demand uses a point estimate or the lower bound of the interval; and
- whether extrapolation was appropriate at all on the facts.
Because the extrapolated figure drives both the civil demand and, in a criminal case, the guideline loss calculation, this is frequently the single most valuable technical work in the matter. A sample-level correction that looks small can move a case by several offense levels.
Medicare Advantage and risk adjustment
A distinct enforcement theory has grown up around Medicare Part C, and it does not fit the billing framework above.
Medicare Advantage plans are paid a capitated amount per enrollee, adjusted upward for documented diagnoses that indicate greater expected cost. The payment therefore turns not on services billed but on diagnosis codes submitted. The enforcement theory follows directly: that diagnoses were submitted which were not supported by the medical record, or which were identified through chart reviews and in-home assessments designed to find revenue-generating codes without corresponding treatment.
Three features make these matters unlike ordinary billing cases.
The defendant population is different. Plans, provider groups in risk-sharing arrangements, chart-review vendors and the physicians whose records support the codes — all with different knowledge and different roles.
The “claim” is a diagnosis, not a service. The question is whether the record supports the code, which makes the case a documentation and clinical-judgment dispute at its core rather than a question of whether something happened.
One-sided review is the recurring allegation. Where a chart review program was designed to add diagnoses but not to delete unsupported ones, the government characterizes the asymmetry as knowledge. Whether a review program was genuinely one-directional, and who designed it that way, is the contested question.
Because Medicare Advantage payments are federal funds, the exposure runs through the same three tracks — § 1347 criminally, the False Claims Act civilly, and exclusion administratively. Note that 42 U.S.C. § 1320a-7k(d) expressly includes “Medicare Advantage organization[s]” within the persons subject to the 60-day overpayment rule.
What happens to the practice
The consequences of a Medicare or Medicaid fraud matter are rarely confined to the case.
- Exclusion. Mandatory under 42 U.S.C. § 1320a-7(a) on certain convictions, for a minimum of five years — rising to ten with one prior qualifying conviction and to permanent with two. Permissive exclusion under § 1320a-7(b) reaches conduct including misdemeanor financial-misconduct convictions, license revocation, and failure to grant immediate access to the OIG or an MFCU.
- Entity exclusion. Under § 1320a-7(b)(8), an entity can be excluded where a person with a 5 percent or greater ownership or control interest, or who is “an officer, director, agent, or managing employee,” has been convicted, penalized or excluded — and the statute reaches transfers of that interest to a family or household member made “in anticipation of (or following)” the event.
- Licensure. State medical boards act on federal outcomes, sometimes on charges alone.
- Payer contracts and hospital privileges. Commercial payers terminate; medical staff bylaws require reporting.
- Immigration consequences for non-citizen providers, where the offense is an aggravated felony.
The through-line is that the offense of conviction determines most of this, which means the charge is the thing to negotiate. Our healthcare fraud attorney hub sets out the three-track framework — criminal, civil and administrative — in which those trade-offs are made. Where referrals or compensation are in issue rather than coding, see Anti-Kickback and Stark; where a whistleblower is behind the investigation, see False Claims Act and qui tam defense.
The first two weeks
What is done in the fortnight after a practice learns of an investigation shapes the rest of it.
- Litigation hold, immediately and in writing. The EHR, the practice management system, email, texts, and personal devices used for work. Turn off auto-deletion. Document that you did.
- No edits to any record, for any reason. Not to complete, not to clarify, not to correct. The audit log will show it, and a defensible billing dispute becomes an obstruction case. A genuine clinical addendum must be dated and identified as one.
- Map what else the same records support. Claims submitted electronically carry wire fraud exposure; practice revenue moved between accounts carries money laundering exposure; distributions taken from the practice carry tax exposure and, where the money belonged to a partner or an employer, embezzlement exposure. The billing question is rarely the only question, and the framework for how the counts combine is on the white collar crime lawyer hub.
- Answer the payment suspension. Under 42 C.F.R. § 455.23 the provider has an express right to submit written evidence, and there are enumerated good-cause grounds — including partial suspension where the allegation is confined. The practice’s cash position will not wait for a sequential process.
- Brief the staff on their rights, correctly. They are free to speak to agents and free to decline; they may have counsel; the practice will pay for separate counsel where appropriate. Saying that is lawful. Telling them what to say is not.
- Do not contact referral sources, former employees or patients about the investigation. This is how obstruction charges are made, and it is the most common serious error.
- Get an independent coding review under privilege, directed by counsel, so that the practice knows what its own records show before the government tells it.
- Separate the entity’s counsel from the individuals’. The practice’s lawyer represents the practice. Officers and physicians need their own from the outset, not after interests diverge.
- Assess the 60-day clock. If the review identifies an overpayment, the obligation under 42 U.S.C. § 1320a-7k(d) engages, and the interaction between complying with it and defending the case has to be worked out deliberately.
Where these cases are defended
The claims data, examined properly. The government’s exhibit is a summary of the billing. Summaries embed classification decisions, and those decisions are testable.
Documentation versus conduct. A great many “fraud” cases are documentation cases. Establishing that the service occurred, that the clinician’s judgment was defensible, and that the record reflects a documentation habit rather than a fabrication changes the character of the matter.
Intent, in a field of ambiguous rules. Coverage determinations, contractor guidance and coding manuals conflict and change. A consistently applied, defensible reading of ambiguous guidance, documented at the time, is not a scheme.
Attribution. Who selected the code, who set the policy, who had authority. In group practices and management-company arrangements the physician whose NPI appears on the claim may have had no role in the coding.
Materiality, on the civil side. Escobar and its progeny — covered on our false claims act attorney page — make continued payment with knowledge strong evidence of immateriality.
The extrapolation. Set out above.
Where a conviction has already been entered, direct review runs through federal appeals and claims outside the trial record through a § 2255 motion. The wider federal framework, including the conspiracy statutes and the guideline loss table, is on the white collar crime lawyer hub; sentencing itself is covered in our federal sentencing pages. Elizabeth Franklin-Best, P.C. is a federal criminal defense attorney practice representing providers nationwide.
Frequently Asked Questions About Medicare Fraud Charges
My Medicaid payments stopped without notice. What happened?
Almost certainly a payment suspension under 42 C.F.R. § 455.23, which requires a State Medicaid agency to “suspend all Medicaid payments to a provider after the agency determines there is a credible allegation of fraud for which an investigation is pending,” unless good cause exists. Notice is due within five days — unless law enforcement asked in writing to delay it, in which case the delay runs 30 days at a time, renewable twice, to a maximum of 90. So the money can stop three months before you are told why.
Can I do anything about a payment suspension?
Yes, and quickly. The regulation requires the notice to “[i]nform the provider of the right to submit written evidence for consideration by [the] State Medicaid Agency,” and it enumerates good-cause grounds for not suspending or for suspending only in part — including that the State determines “based upon the submission of written evidence” that the suspension should be removed, that beneficiary access would be jeopardized because you are “the sole community physician or the sole source of essential specialized services in a community” or serve “a large number of beneficiaries within a HRSA-designated medically underserved area,” and that the allegation “focuses solely and definitively on only a specific type of claim or arises from only a specific business unit.”
What is the 60-day overpayment rule?
42 U.S.C. § 1320a-7k(d) requires a provider who has received an overpayment to report and return it “by the later of — (A) the date which is 60 days after the date on which the overpayment was identified; or (B) the date any corresponding cost report is due.” An overpayment is funds “to which the person, after applicable reconciliation, is not entitled.” Missing the deadline has a specific consequence: the retained money “is an obligation … for purposes of section 3729” — a False Claims Act reverse false claim, with treble damages and per-claim penalties.
Should I refund suspected overpayments right away?
The obligation is real and the consequence of ignoring it is severe, so the answer is not “wait and see.” But a refund fixes an amount and a period and can be read as an admission, so scope, framing and the accompanying written explanation matter. And the 60-day clock runs from identification, which is a contested concept — a reasonably diligent inquiry, promptly begun, is what preserves the argument. This should be handled with counsel rather than by the billing department alone.
A patient told me an investigator called them. What does that mean?
That the investigation has reached the beneficiary-interview stage, which usually means the claims analysis is already done. Investigators ask patients whether a service was provided, how long a visit lasted, and whether they recall a particular test or item. Those recollections are years old and imprecise — a fair subject of cross-examination — but they are persuasive to a jury when they line up with the billing data. What matters on the practice’s side is that no one from the practice contacts those patients about the investigation. That is how obstruction charges are made.
What is a Medicaid Fraud Control Unit?
A state law-enforcement body with its own investigators and prosecutors, charged with investigating and prosecuting Medicaid provider fraud and patient abuse under state law. It is separate from the federal Strike Force teams that work Medicare cases, and a provider participating in both programs can face both at once, on the same billing, with no obligation on either to coordinate.
Does Medicare fraud cover private insurance too?
The criminal statute does. 18 U.S.C. § 1347 protects any “health care benefit program,” which is broader than the federal programs and reaches commercial payers. The Medicare- and Medicaid-specific machinery — payment suspension under 42 C.F.R. § 455.23, the 60-day overpayment rule, exclusion under 42 U.S.C. § 1320a-7 — applies only to the federal programs. So a commercial billing dispute can be prosecuted federally while carrying none of the program-specific administrative consequences.
Is upcoding a crime or a billing dispute?
It can be either, and the difference is intent. Selecting a higher-level code than the documentation supports is a coding error; doing it knowingly to obtain a higher payment is fraud. The Civil Monetary Penalties Law reaches a “pattern or practice” of presenting claims “based on a code that the person knows or should know will result in a greater payment … than the code the person knows or should know is applicable” — 42 U.S.C. § 1320a-7a(a)(1)(A). An independent coding review is usually the first substantive step.
The government audited 40 claims and is demanding millions. How?
Statistical extrapolation: an error rate found in a sample is applied to the whole population of claims in the period. It is permitted, but it is a methodology, and it is challengeable on the sampling frame, the sample size and stratification, the individual error determinations inside the sample, and the confidence interval applied. Because the extrapolated figure drives both the civil demand and the criminal guideline loss, this is often the most valuable technical work in the case. How that loss figure then drives the range is set out in our federal sentencing pages.
Can I be excluded from Medicare without a conviction?
Yes. Mandatory exclusion under 42 U.S.C. § 1320a-7(a) follows certain convictions, but permissive exclusion under § 1320a-7(b) reaches conduct that includes license revocation or suspension, failure to disclose required ownership information, failure to supply payment information, and failure to grant immediate access to the OIG or a Medicaid Fraud Control Unit. Several of those grounds require no conviction at all.
Federal agents want to talk to my staff. What should I tell them?
That they are free to speak and free to decline, that they may have their own lawyer, and that the practice will pay for one where that is appropriate. Telling employees their rights is lawful. Telling them what to say, or discouraging them from cooperating, is obstruction. Employees are typically contacted at home, in the evening, without notice, and a practice that has told its people in advance what to expect will handle it far better than one that has not.
An auditor is asking for more records than the original request. Is that normal?
It happens for innocent reasons, but a review that broadens without explanation — particularly one that starts asking about specific referral sources, specific employees, or periods well outside the original sample — is a signal worth taking seriously. Most criminal health care cases begin as payment review, and the transition to a fraud referral is not announced. The response strategy that is right for an administrative audit (explain the billing, produce the documentation) is the wrong one once a matter has been referred. That assessment should be made before the next production goes out.
Should I appeal the overpayment demand?
Usually, and for two reasons beyond the money. The appeal ladder under 42 C.F.R. § 405.904 — redetermination, reconsideration by a Qualified Independent Contractor, an ALJ hearing, Council review, and then federal district court — surfaces the government’s theory early, in a forum where the stakes are financial rather than penal. And a favorable ALJ finding on medical necessity or documentation sufficiency is made by a neutral adjudicator on the same facts a prosecutor is looking at. The countervailing point is real: what you file is your own statement and it is available, so where criminal exposure is live the submissions need the same care as anything else.
What is risk-adjustment fraud?
The Medicare Advantage version of these cases. Plans are paid a per-enrollee amount adjusted upward for documented diagnoses, so the payment turns on diagnosis codes rather than on services billed. The enforcement theory is that diagnoses were submitted that the medical record did not support, often identified through chart-review programs or in-home assessments designed to find revenue-generating codes. The recurring allegation is that a review program added diagnoses but did not delete unsupported ones — and whether it was genuinely one-directional, and who designed it that way, is the contested question.
Does this end my career?
Not automatically, and the answer depends far more on the offense of conviction than on the sentence. Mandatory exclusion follows certain convictions; others do not trigger it. A resolution structured with the exclusion consequences in mind is a materially different outcome from one negotiated only on custody exposure. That is why exclusion has to be part of the discussion from the first conversation with the prosecutor, and why it belongs in the federal criminal defense strategy rather than in the compliance file. Where a conviction has already been entered, review runs through federal appeals and, for claims outside the record, a § 2255 motion.
By Elizabeth Franklin-Best, Esq. — Principal Attorney & Founder, Elizabeth Franklin-Best, P.C.
Medicare Billing Under Review?
A billing audit, a payment suspension, and a criminal investigation can all start from the same data pull. Knowing which one you are in determines what you should do next.
Representation begins with a paid, one-hour consultation — a working session in which we review where matters stand and tell you honestly what options remain. We do not promise outcomes.
Reviewed for legal accuracy by Elizabeth Franklin-Best, Esq., Principal Attorney·September 2026