Government contractor |

One Door for Criminal Health Care Fraud Disclosures: DOJ’s Fraud Division and HHS-OIG Consolidate Self-Disclosure—and Close the SDP to Criminal Conduct

November 11, 2026

Health care providers, suppliers, manufacturers, Medicare Advantage organizations, and other participants in Federal health care programs that uncover potentially criminal billing, kickback, or excluded-person conduct inside their own operations now face a materially different—and less forgiving—self-disclosure roadmap.

On October 15, 2026, the Justice Department’s National Fraud Enforcement Division (“Fraud Division”) and the HHS Office of Inspector General (“HHS-OIG”) issued a joint Policy on Coordination of Voluntary Self-Disclosure in Health Care Fraud Matters (the Policy), and HHS-OIG simultaneously updated its Health Care Fraud Self-Disclosure Protocol (“SDP”). See also the DOJ press release (Oct. 15, 2026).

The government touts the consolidation as offering simplification: a single qualifying voluntary self-disclosure to the Fraud Division’s Health Care Fraud Section now earns the benefits of both DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP) and the HHS-OIG SDP, with no duplicate submission through the OIG portal. The less-advertised—but arguably more consequential—change runs the other way. HHS-OIG has expressly closed the SDP to disclosure of Federal crimes, and a disclosure made only to HHS-OIG generally will not qualify as a voluntary self-disclosure to DOJ or support a CEP declination. For organizations that historically treated the SDP as the default first call, the choice of which door to knock on first now carries real criminal-exposure consequences.

What the Joint Policy Does

The Policy establishes the following core rules:

One disclosure, two sets of benefits. A company that makes a voluntary self-disclosure to the Health Care Fraud Section “within the meaning of the CEP,” relating to conduct involving a Federal health care program as defined in 42 U.S.C. § 1320a-7b(f), receives the benefits of the HHS-OIG SDP. Only one disclosure is required to obtain both CEP and SDP benefits. (Policy § I, ¶ 1; § III.A).
DOJ forwards the disclosure to OIG. The Health Care Fraud Section will promptly provide HHS-OIG a copy of the disclosure upon receipt. (Policy § III.B).
OIG-only disclosure generally does not count with DOJ. Consistent with footnote 5 of the CEP, a disclosure made only to HHS-OIG under the SDP generally does not qualify as a voluntary self-disclosure to the Fraud Division and generally will not satisfy the criteria for a Part I CEP declination. Such a disclosure may still be considered as part of a company’s cooperation and remediation credit. (Policy § I, ¶ 2; § III.C).
Good-faith disclosure to another DOJ component still qualifies. Quoting the CEP, the Policy confirms that good-faith disclosure to one DOJ component, where the matter is later brought to another appropriate component, also qualifies. (Policy n.3).
Effective date. The Policy applies to voluntary self-disclosures of potential criminal violations affecting one or more Federal health care programs made to the Fraud Division on or after October 15, 2026. (Policy § III.A).
Submission channel. DOJ directs self-disclosures to corporate.enforcement@usdoj.gov. (DOJ press release).

Important Limits Buried in the Footnotes

Several qualifications in the Policy should temper any expectation that a DOJ disclosure resolves everything:

Mandatory exclusion is not covered. The SDP benefits conferred through a DOJ disclosure do not include resolution of mandatory exclusion under 42 U.S.C. § 1320a-7(a). (Policy n.4). Organizations whose conduct could result in a conviction triggering mandatory exclusion must plan for that exposure separately.
Declination remains discretionary. Fraud Division prosecutors retain discretion to recommend a declination after weighing the severity of the circumstances against the company’s self-disclosure, cooperation, and remediation. (Policy n.5).
No enforceable rights. The Policy expressly disclaims creating any right or benefit enforceable at law or in equity. (Policy n.1).
The CEP’s definition controls. A disclosure qualifies only if it is made to the Fraud Division (or another qualifying DOJ component) and satisfies every element of the CEP’s definition of voluntary self-disclosure. (Policy § II.A; CEP).

What Changed in the Updated HHS-OIG SDP

HHS-OIG’s October 15, 2026 SDP update implements the Policy and makes several operational changes providers should note:

Federal crimes are now expressly ineligible. The SDP adds a fifth category of ineligible conduct: it is not available for disclosure of Federal crimes, which should be disclosed to DOJ. Any criminal disclosure that does come through the SDP will be referred to DOJ for resolution. (SDP §§ 2.C, 6).
The 90-day clock now runs from submission. Disclosing parties expected to complete their internal investigation and damages calculation now have 90 days from the date of the initial submission—not from acceptance into the SDP, as before. (SDP §§ 1.B, 3.A). This effectively front-loads the investigation and damages work before filing.
Benefits for qualifying civil/administrative matters remain. These include a presumption against requiring integrity agreement obligations in exchange for a release of permissive exclusion, a general minimum multiplier of 1.5 times single damages, and suspension of the 60-day overpayment report-and-return obligation under 42 U.S.C. § 1320a-7k(d) upon OIG’s acknowledgment of a timely submission (see 42 C.F.R. § 401.305(b)(2)(i)). (SDP § 1.B).
Minimum settlements are unchanged. OIG continues to require a $100,000 minimum settlement for kickback-related submissions and $20,000 for all others. (SDP § 8).
Physician self-referral-only conduct still goes to CMS. Arrangements implicating only the physician self-referral law, without accompanying Anti-Kickback Statute (AKS) exposure, remain outside the SDP and belong in CMS’s Self-Referral Disclosure Protocol. (SDP §§ 2.C, 7).

The Parallel Civil Track: The DOJ–HHS FCA Self-Disclosure Pilot Program

The Policy does not stand alone. DOJ’s Civil Division and HHS (the Office of the General Counsel, OIG, and CMS) have also launched a Healthcare Self-Disclosure Pilot Program (FCA SDPP), announced October 22, 2026, for potential False Claims Act violations previously unknown to the government (HHS press release (Oct. 22, 2026)). Key features include a coordinated civil release with no factual admissions; a repayment of 1.25–1.6 times a “Base Self-Disclosure Repayment”; no Corporate Integrity Agreement as part of any resolution of OIG’s permissive exclusion authorities; and CMS’s agreement not to impose civil monetary penalties or seek revocation in pilot resolutions. Submissions must be made to FCA-SDPP@usdoj.gov by 11:59 p.m. on April 22, 2027; late or partial submissions will not be reviewed. (FCA SDPP §§ II–III).

The FCA SDPP dovetails with the criminal Policy: it is limited to potentially civil conduct, routes potentially criminal conduct to the Fraud Division, and provides that a company that has made a qualifying criminal disclosure to the Fraud Division need not make a duplicative FCA SDPP submission, with supplementation requested only as needed if the company also seeks a civil FCA release. (FCA SDPP n.1).

Why the Timing Matters: A Rapidly Escalating Enforcement Environment

The Policy is one piece of a deliberate build-out. DOJ created the Fraud Division on April 7, 2026 (DOJ press release). On October 1, 2026, Assistant Attorney General Colin M. McDonald issued Directive 26-12: Corporate Enforcement in the Fight Against Fraud. Then, on October 20, 2026, DOJ launched the Fraud Whistleblower Incentive Program (WHIP), which pays tipsters $10,000 to $30,000 upon the filing of criminal charges—rather than after final resolution—for information relating to Federal health care offenses and fraud on specified Federal programs. For health care, WHIP prioritizes hospice, home health care, day care, and special services fraud. (WHIP press release; WHIP terms).

The practical message is unmistakable: employees, contractors, and business partners now have a faster financial incentive to go directly to DOJ, while the window in which an organization can still claim a voluntary disclosure is shrinking. Delay spent debating where to disclose—or defaulting to an OIG-only filing for conduct that may be criminal—can forfeit declination eligibility altogether.

Analysis: The Hard Part Is the Triage

The Policy simplifies where to file once an organization concludes conduct may be criminal. It does not simplify the threshold judgment itself. The same arrangement—an illegal remuneration arrangement, billing for medically unnecessary services, or employment of an excluded person—can support criminal, civil FCA, and administrative CMP theories simultaneously, and the government’s own documents describe these as overlapping. Organizations should expect the following pressure points:

Criminal versus civil characterization. The AKS is a criminal statute that also triggers CMP and FCA liability. An organization that characterizes knowing kickback conduct as purely civil and files only with OIG risks losing CEP credit if DOJ later views the conduct as criminal.
Required admissions. The SDP requires disclosing parties to acknowledge a potential violation and identify the specific laws implicated; equivocal statements can lead to removal. (SDP § 2.B). Counsel must coordinate these acknowledgments with criminal exposure analysis before anything is filed with any agency.
Individuals are not protected by the entity’s disclosure. The Policy and CEP address corporate resolutions. Executives, physicians, and employees involved in the conduct may have separate and divergent interests, which raises Upjohn-warning, separate-counsel, and indemnification/advancement questions.
Employment-law crosscurrents. Internal reporters may simultaneously be WHIP tipsters or potential qui tam relators. Discipline or termination decisions involving anyone connected to the reported conduct must be reviewed for retaliation exposure, including under the FCA’s anti-retaliation provision, 31 U.S.C. § 3730(h).
The 60-day overpayment suspension may not travel with a DOJ-first disclosure. CMS’s regulation suspends the Medicare Part A/B report-and-return deadline only when (i) OIG acknowledges receipt of an SDP submission, (ii) CMS acknowledges receipt of a Self-Referral Disclosure Protocol submission, (iii) the provider requests an extended repayment schedule, or (iv) the provider is conducting a timely, good-faith investigation of related overpayments—a suspension that ends no later than 180 days after the initial overpayment was identified. (42 C.F.R. § 401.305(b)(2)–(3)). A disclosure to DOJ is not among the listed triggers. Neither the Policy nor the updated SDP addresses how the suspension applies when the Health Care Fraud Section forwards a disclosure to OIG and no SDP submission is made; the SDP continues to describe the suspension as arising when OIG acknowledges receipt of an SDP submission. (SDP § 1.B). When CMS adopted the regulation, it reportedly declined commenters’ requests to extend the suspension to disclosures made to DOJ or Medicaid Fraud Control Units. (81 Fed. Reg. 7654 (Feb. 12, 2016)). [verify pin cite for the DOJ/MFCU comment response in the 2016 preamble] The regulation also covers only Medicare Parts A and B; the statutory 60-day obligation for Medicaid overpayments under 42 U.S.C. § 1320a-7k(d) has no corresponding regulatory suspension. Until DOJ, OIG, or CMS speaks to the question, a DOJ-first discloser should not assume the SDP’s overpayment suspension attaches automatically.
Precaution: As of November 11, 2026, we found no DOJ, HHS-OIG, or CMS guidance on whether the 60-day overpayment suspension applies when a disclosure goes to DOJ first. As written, the regulation does not cover that route. (42 C.F.R. § 401.305(b)(2)). Organizations disclosing to the Fraud Division should not assume the suspension applies and should plan for the 60-day report-and-return obligation accordingly.

Action Items by Stakeholders

Boards and senior leadership should:

Obtain training or education about Federal Sentencing Guidelines organizational and person exposure for criminal actions and best practices for preventing and mitigating these risks.
Confirm that the organization’s disclosure-decision framework assigns clear authority and timelines for deciding whether, when, and where to disclose, and that it reflects the DOJ-first rule for potentially criminal conduct.
Require periodic reporting on hotline volume, investigation aging, and disclosure decisions, recognizing that WHIP compresses the time available to act voluntarily.

Compliance Officers should:

Update self-disclosure policies, investigation protocols, and escalation matrices that currently direct federal program issues to the OIG SDP by default.
Build a documented triage step that screens every substantiated matter for potential criminal exposure before choosing among the Fraud Division, the OIG SDP, the CMS SRDP, the FCA SDPP, or a routine contractor refund.
Refresh exclusion screening (including full-workforce LEIE screening, which the SDP requires before disclosing an excluded-person matter) and AKS arrangement reviews, particularly in hospice, home health, and day care service lines that WHIP prioritizes. (SDP § 3.C).

General Counsel should work with qualified outside counsel to:

Tighten compliance controls and documentation.
Structure internal investigations under privilege from the outset, with criminal-exposure assessment by counsel experienced in DOJ health care fraud matters.
Calendar the FCA SDPP’s April 22, 2027 deadline for potentially civil-only matters, and evaluate whether any pending matters should be routed through the Fraud Division to capture both CEP and SDP benefits.
Assess mandatory-exclusion risk separately, as the Policy does not resolve it.
For DOJ-first disclosures involving quantified Medicare or Medicaid overpayments, request written confirmation from the Health Care Fraud Section and HHS-OIG at the time of disclosure as to whether OIG will treat the forwarded disclosure as an acknowledged SDP submission for purposes of 42 C.F.R. § 401.305(b)(2)(i). Absent confirmation, track the 180-day investigation suspension and evaluate, in coordination with the government, whether to return quantified overpayments through the MAC or an extended repayment schedule; OIG credits pre-resolution refunds toward settlement but is not bound by amounts repaid outside the SDP. (SDP § 10).

Human Resources should work with employment counsel experienced with health care and other Federal Sentencing Guidelines risk management to:

Strengthen training and compliance oversight and enforcement.
Tighten internal reporting channels and non-retaliation messaging so employees see internal reporting as credible and safe.
Route any adverse employment action involving a reporter, witness, or implicated employee through legal review before implementation, and ensure investigation interviews include appropriate Upjohn warnings.
Review separation, confidentiality, and release templates to confirm they do not purport to restrict reporting to government agencies.

Billing, Revenue Cycle, and Finance leaders should:

Preserve claims, payment, and arrangement data needed to support the SDP’s damages methodologies (including statistically valid sampling of at least 100 items) or the FCA SDPP’s Base Self-Disclosure Repayment. (SDP § 3.B; FCA SDPP § II).
Coordinate any overpayment refunds with counsel before processing, since repayments outside the SDP do not bind OIG and may affect the disclosure strategy. (SDP § 10).

Bottom Line

For potentially criminal health care conduct, the default first call is now DOJ’s Fraud Division, not HHS-OIG. The Policy reduces duplication for organizations that get the triage right, but it raises the cost of getting it wrong. Health care organizations should update their disclosure frameworks now, before a hotline report or a WHIP tip forces the decision on a compressed timeline.

For Help or More Information

The author of this update, Cynthia Marcotte Stamer has decades of experience advising and assisting health industry clients to design, audit, and defend their organizations and practices including conducting audits and investigations, designing and updating compliance and risk management programs, responding to government investigations, conducting transaction, governance, and other due diligence, and assisting with other legal and operational compliance and risk management and legislative and regulatory affairs. She is available to assist your organization in assessing the impact of these developments and navigating the compliance and strategic steps that follow. For more information about these or other health care, managed care and other health benefits, or other health industry laws or concerns, contact Ms. Stamer via e-mail or via telephone at (214) 452 -8297.

About the Author

Peer recognized as “Top Rated Lawyer” and “LEGAL LEADER™ “Top Rated Lawyer” and “Best Lawyer” for her work in Health Care Law, Labor and Employment Law; ERISA & Employee Benefits,” and “Business and Commercial Law,” Cynthia Marcotte Stamer is an A Martindale-Hubble “AV-Preeminent” (Top 1%) attorneys board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for her more than 35 years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications including leading edge work on PBM, pharmacy and pharmaceutical and other health care, managed care, insurance, and insured and self-insured contracting, design, administration and regulation..

Author of numerous highly regarded works on health care fraud and other compliance, risk management and operations, Chair of the Tort Trial and Insurance Practice Section Medicine and Law Committee, past Chair of the ABA Health Law Section Managed Care & Insurance Interest Group, the ABA International Section Life Sciences Committee and the former Group Chair and Welfare Benefit Committee Co-Chair of the ABA RPTE Employee Benefits & Other Compensation Group, Ms. Stamer is widely recognized for her decades of pragmatic, leading edge work, scholarship and thought leadership on health industry legal, public policy and operational concerns.

Ms. Stamer’s work throughout her career has focused heavily on working with hospitals, health care systems, long term care, rehabilitation, home health, hospice, clinics, and other health care organizations; physician and other provider organizations and practitioners; accreditation, medical staff, peer review, and quality committees and organizations; billing, audit, practice management, utilization management, EMR, claims, payroll and other technology, billing and reimbursement and other services and product vendors and services organizations; pharmaceutical, pharmacy, and prescription benefit management and organizations; DME; health care and managed care, health and other employee benefit plan, insurance and financial services and other public and private organizations; consultants; products and solutions consultants and developers; investors; managed care organizations, self-insured health and other employee benefit plans, their sponsors, fiduciaries, administrators and service providers, insurers and other payers, health industry advocacy and other service providers and groups and other health and managed care industry clients as well as federal and state legislative, regulatory, investigatory and enforcement bodies and agencies on billing and reimbursement, government investigations and enforcement, and other legal and operational compliance and risk management, performance and workforce management, regulatory and public policy, and other legal and operational concerns.

Author of a multitude of highly regarded publications and presentations, Ms. Stamer is widely recognized for her thought leadership on these and other health care, managed care and other health plan,and other health industry matters. In addition, Ms. Stamer contributes her time and leadership to numerous policy, professional, civil and other organizations including service as the, the American Bar Association (ABA) International Section Life Sciences Committee Vice Chair, a Scribe for the ABA Joint Committee on Employee Benefits (JCEB) Annual OCR Agency Meeting and a former Council Representative, Past Chair of the ABA Managed Care & Insurance Interest Group, former Vice President and Executive Director of the North Texas Health Care Compliance Professionals Association, past Board President of Richardson Development Center (now Warren Center) for Children Early Childhood Intervention Agency, past North Texas United Way Long Range Planning Committee Member, and past Board Member and Compliance Chair of the National Kidney Foundation of North Texas, and a Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also shares her extensive publications and thought leadership as well as leadership involvement in a broad range of other professional and civic organizations. For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press, Inc.™ resources.

Solutions Law Press, Inc. invites you receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstance at the particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author reserves the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often rapidly evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. The author and Solutions Law Press, Inc. disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2026 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press, Inc.™ For information about republication, please contact the author directly. All other rights reserved.

Leave a Comment » | Academic medicine, Anti-KickBack, ASC, Conditions of Participation, Controlled Substances, Corporate Compliance, DEA, Durable Medical Equipment, Employer, Employment law, FDA, Federal Sentencing Guidelines, Government contractor, Grant recipients, Grants, Health Care, Health care coding, Health Care Finance, Health Care Fraud, Health Care Provider, Health Care Quality, Health Plans, healthcare, Heath Care Exchange, HHS, HIPAA Cyber Crime, Hospice, Hospital, Hospital, Indian Health, Inpatient Rehabilitation, Inpatient Rehabilitation Facility, laboratory testing, Laboratory tests, Life Sciences, long-term care, Medicaid, Medicaid Advantage, Medicaid Advantage, medical devices, Medicare, Medicare Advantage, Medicare Advantage, Medicare Fee Schedule, Medicare Prescription Drug Program, Money Laundering, nursing home, OIG, Pharmaceudical, pharmaceutical, Pharmacy, Prescription Drugs, Psychiatric, Reimbursement, retaliation, Stark, Veterans Health, Veterans Health Care, Whistleblower | Permalink
Posted by Cynthia Marcotte Stamer

CMS Imposes Nationwide Enrollment Moratoria on Hospices and Home Health Agencies; Issues New Medicaid State Directed Payment Limits

May 18, 2026

Hospices and home health agencies, referring providers, states, and patients and their caregivers should prepare to cope with the likely impacts of a new Medicare program enrollment moratorium on new hospice and home health agencies and changes in Medicare and Medicaid reimbursement rules announced last week as part of a new federal antifraud initiative.

KEY TAKEAWAYS: CMS has imposed immediate nationwide six-month enrollment moratoria for home health agencies and hospices in Medicare, effective May 13, 2026. Separately, CMS has issued guidance capping Medicaid State Directed Payments at or below Medicare rates. Existing enrolled providers are unaffected by the moratorium and may continue billing with the understanding that they must ensure their billing and other practices can withstand scrutiny of newly heightened fraud investigations and review. Prospective new providers and certain ownership change transactions are blocked during the moratorium period.

BACKGROUND

On May 13, 2026, the Centers for Medicare & Medicaid Services (CMS) published two Federal Register notices imposing immediate, nationwide, six-month enrollment moratoria on new Medicare enrollment for hospice providers and home health agencies (HHAs). The moratoria are effective as of the May 13, 2026 publication date and apply to all states, territories, and the District of Columbia. This action follows an earlier, still-active moratorium on durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) companies imposed in February 2026, making these among the most expansive fraud-prevention actions in CMS’ history.

At the same time, CMS issued preliminary guidance to states regarding new payment limits on Medicaid State Directed Payments (SDPs) under managed care, pursuant to the recently enacted “One Big Beautiful Bill Act.”

NATIONWIDE MEDICARE ENROLLMENT MORATORIA: HOSPICES AND HOME HEALTH AGENCIES

Legal Authority

CMS derives its moratorium authority from Section 1866(j)(7) of the Social Security Act, added by the Affordable Care Act, and implemented through 42 C.F.R. § 424.570. CMS may impose a temporary moratorium on new Medicare, Medicaid, or CHIP enrollment when it determines there is a significant potential for fraud, waste, or abuse. The decision to impose a moratorium is not subject to judicial review.

Scope and Effective Date

Both moratoria became effective May 13, 2026 and will remain in effect for six months, subject to renewal in additional six-month increments. CMS will publish any extension or termination in the Federal Register. The moratoria cover:

All new initial Medicare enrollment applications for hospice providers and HHAs (including HHA branch offices)
Certain changes in majority ownership (CIMOs) that would require initial re-enrollment—a mechanism CMS has identified as frequently exploited to obscure bad-actor control

The moratoria do NOT affect:

Currently enrolled hospice providers and HHAs, which may continue providing services and billing Medicare without interruption;
Changes in practice location (unless relocating from outside to inside the moratorium area);
Routine administrative changes (phone number, address, etc.);
Any enrollment application received by a Medicare contractor before May 13, 2026

Rationale: Data-Driven Findings

CMS grounded both moratoria in extensive data analysis and law enforcement experience. Key findings cited by the agency include:

In Los Angeles County alone, the number of enrolled HHAs rose more than 40 percent between 2019 and 2023, with over 1,000 new HHAs enrolling despite no corresponding change in the Medicare beneficiary population. Los Angeles County now holds roughly 12–15 percent of all HHAs nationwide, while accounting for only approximately 3 percent of the national Medicare beneficiary community.
Clusters of multiple HHAs operating from a single shared address have been detected in Ohio, Texas, Michigan, North Carolina, and Nevada, which CMS views as a strong indicator of fraud.
CMS, in coordination with Vice President JD Vance’s Anti-Fraud Task Force, has suspended payments to approximately 800 hospices and HHAs in Los Angeles, which were responsible for $1.4 billion in Medicare spending in the prior year, with $70 million in payments suspended to date.
Numerous recent criminal convictions and civil settlements involve hospice and HHA operators across many states, including multimillion-dollar fraud schemes in Massachusetts, Michigan, Texas, Ohio, Illinois, Oklahoma, and Pennsylvania.

CMS emphasized that because fraud schemes are “highly migratory,” a nationwide moratorium—rather than a targeted geographic one—is necessary to prevent bad actors from simply relocating to avoid scrutiny.

Applicability to Medicaid and CHIP

The moratoria announced in the Federal Register apply to Medicare enrollment only. CMS has expressly invited each state to consult with the agency about implementing a parallel moratorium tailored to their Medicaid and CHIP programs. States are not required to comply if they determine that doing so would adversely affect beneficiary access to care.

Accompanying Enforcement Intensification

CMS also announced that, during the moratorium period, it will:

Intensify targeted investigations and deploy advanced data analytics;
Accelerate revocation and deactivation of currently enrolled providers suspected of fraud;
Continue nationwide site visits to hospices to verify operations;
Maintain heightened oversight of newly enrolled hospice providers in states identified as high-risk: Arizona, California, Georgia, Ohio, Nevada, and Texas;
Operate a new publicly available hospice scoring system to increase transparency;
Implement enhanced HHA enrollment screening, including site verification and fingerprinting-based background checks; and
Expand a pre- and post-claim review demonstration for HHA claims in Florida, Illinois, Oklahoma, Ohio, North Carolina, and Texas.

Existing hospice and home health providers and those in the targeted regions particularly are urged to work with qualified legal counsel within the scope of attorney-client privilege to assess and tighten their existing practices and audit prior billings in response to recent OIG and other recent reports to assess and address risks from practices the government now views as fraudulent or aggressive as this enhanced scrutiny targets identification of practices the government views as fraud and other aggressive practices by current providers. Providers subjected to this scrutiny must be prepared to defend their actions to avoid fraud charges, recoupment, program participation suspensions or exclusions or other adverse consequences.

Moratorium Termination

Under 42 C.F.R. § 424.570(d), CMS may lift a moratorium early if: (1) a Presidential disaster declaration applies; (2) circumstances warranting the moratorium have abated; (3) a public health emergency is declared; or (4) the Secretary determines the moratorium is no longer necessary. Upon lifting, formerly blocked provider types would be assigned to the “high” screening level for six months.

Appeals

A provider whose enrollment application is denied due to the moratorium may appeal under 42 C.F.R. part 498. However, the scope of such an appeal is limited solely to whether the moratorium applies to the particular provider—not to the merits of CMS’ decision to impose the moratorium. Application fees will be refunded where a denial results from the moratorium.

CMS GUIDANCE ON MEDICAID STATE DIRECTED PAYMENT LIMITS

Overview

On September 9, 2025, CMS issued preliminary guidance to states implementing new federal payment limits on Medicaid State Directed Payments (SDPs) in managed care, as required by the One Big Beautiful Bill Act. SDPs—arrangements that direct how Medicaid managed care plans pay providers—have grown dramatically, from use by only two states in 2016 to 39 states today, with projected annual SDP spending exceeding $124.3 billion for FY 2025 and $144.6 billion for FY 2026.

New Payment Limits

Effective for rating periods beginning on or after July 4, 2025, SDPs for the following service categories must not exceed specified Medicare rate benchmarks:

Inpatient hospital services;
Outpatient hospital services;
Nursing facility services; and
Qualified practitioner services at an academic medical center.

The applicable ceiling is:

100% of the Medicare rate in Medicaid expansion states;
110% of the Medicare rate in non-expansion states; or
Where no Medicare rate exists, the Medicaid state plan rate applies.

Grandfathering

Certain SDPs submitted or approved before July 4, 2025 may qualify for a temporary grandfather period through rating periods beginning January 1, 2028, followed by a phased reduction to meet the new limits. CMS will notify states in approval letters whether a particular SDP likely qualifies for grandfathering.

Next Steps for States

States must revise any pending or future SDP preprints that do not qualify for grandfathering before CMS will continue review. Health care providers participating in SDPs should coordinate with their state Medicaid agencies to understand the impact of these limits on their payment arrangements.

IMPLICATIONS FOR PROVIDERS

Hospice and home health providers should assess the following in light of these actions:

For Currently Enrolled Providers

For currently enrolled providers:

Operations may continue uninterrupted. No action is required to maintain current enrollment status. However, currently enrolled providers must ensure that current and future practices can withstand the heightened oversight and scrutiny HHS and it’s auditors will apply to current and previously submitted bills as part of their fraud investigation and enforcement practices.
Expect heightened CMS scrutiny during the moratorium period, including potential site visits, billing audits, and enhanced data monitoring.
Providers in the identified high-risk states (AZ, CA, GA, NV, OH, TX for hospices) should anticipate heightened oversight and ensure documentation and compliance programs are robust.
Providers in the HHA pre- and post-claim review demonstration states (FL, IL, OK, OH, NC, TX) should review their claims processes for compliance.

For Providers Seeking New Enrollment

For providers seeking new enrollment:

Applications received by a Medicare contractor before May 13, 2026 will be processed. Providers should confirm their contractor’s receipt of a timely-filed application.
Applications submitted on or after May 13, 2026 will be denied. Application fees will be refunded in these instances.
Any denied applicant wishing to contest applicability of the moratorium may appeal under 42 C.F.R. part 498, with the narrow scope described above.
Any provider granted authorization to operate under the programs must be prepared to meticulously comply with the current rules, taking to count all guidance passed and emerging.

For Transactions Involving Ownership Changes

For transactions involving ownership changes:

Parties to acquisitions, mergers, or other transactions involving hospice or HHA ownership should carefully evaluate whether the transaction constitutes a “change in majority ownership” (CIMO) that would require initial re-enrollment under 42 C.F.R. § 424.550.
CIMOs within 36 months of an HHA’s initial enrollment (or most recent prior CIMO) that trigger initial re-enrollment will be blocked during the moratorium. Deal teams should factor this into transaction planning and timelines.

For Organizations Participating in Medicaid Managed Care SDPs

Organizations participating in Medicaid Managed Care SDPs should:

Review existing and planned SDP arrangements for compliance with the new Medicare rate caps.
Identify whether any current SDPs qualify for the grandfathering period and assess the financial impact of the eventual phase-down.
Work with state Medicaid agency partners to ensure pending preprints are revised as necessary.

Patients and Their Caregivers

Patients and their caregivers should anticipate and prepare to cope with likely delays and disruptions in the ability to access care and changes in services as providers respond to the moratorium, rule changes and enforcement. Declines in staffing and services also are likely due to rule changes and reimbursement cuts.

For Help or More Information

The author of this update, Cynthia Marcotte Stamer advises hospices, home health agencies, and other Medicare and Medicaid providers and other health industry clients on enrollment matters, compliance programs, government investigations, transaction due diligence, reimbursement compliance and disputes, audits and investigations, and other legal and operational compliance and risk management and legislative and regulatory affairs. She is available to assist your organization in assessing the impact of these developments and navigating the compliance and strategic steps that follow. For more information about these or other health care, managed care and other health benefits, or other health care developments, please contact Ms. Marcotte Stamer via e-mail or via telephone at (214) 452 -8297.

About the Author

About Solutions Law Press, Inc.™

Leave a Comment » | Conditions of Participation, Corporate Compliance, Doctor, Evidence Based Medicine, Government contractor, Health Care, Health care coding, Health Care Finance, Health Care Fraud, Health Care Provider, Health Care Quality, health care reimbursement, healthcare, HHS, home health, Hospice, hospitals, Inpatient Rehabilitation, Inpatient Rehabilitation Facility, long-term care, Medicaid, Medicaid Advantage, Medicaid Advantage, Medicare, Medicare Advantage, Medicare Advantage, Medicare Fee Schedule, Mergers and Acquisitions, Money Laundering, nursing home, participating provider, Reimbursement | Tagged: Anti-Kickback, CMS, Compliance, Corporate Compliance, Doctor, DOJ, false claims act, Federal Sentencing Guidelines, Health Care, Health Care Compliance, Health Care Fraud, Health Care Provider, Health Care Reimbursement, healthcare, healthcare provider, HEAT, HHS, Home Care, home health, Hospice, Hospitals, Medicaid, Medicaid Fraud, medical, Medicare, Medicare Advantage, Medicare Fraud, Medicare Fraud Task Force, nursing home, OIG, Physician, Physicians, Prospective Payment, Reimbursement, Skilled Nursing, STARK | Permalink
Posted by Cynthia Marcotte Stamer

Stamer “Cybersecurity Jedi Skills Training” Added To 2025 Security Summit Agenda

July 24, 2025

The Information Systems Security Association (“ISSA”) – Los Angeles Chapter (“ISSA-LA”) recently confirmed that Solutions Law Press publisher and author Cynthia Marcotte Stamer will conduct “Cybersecurity Jedi Skills Training” at the 2025 Annual Security Summit 2025 ISSA-LA is hosting on September 17-18, 2025, at the Annenberg Beach House in Santa Monica, California.

Under constant threat from potentially draconian operational, financial and legal mayhem from cybercriminals’ ransomware and other cyberattacks, organizations, investors, breach victims, health care and other business partners, and federal and state regulators increasingly expect cybersecurity and other IT leaders to defend their organization’s proprietary knowledge, workforce, finance, and other mission critical data and systems cyberthreats from dark web with the skill of Jedi knights. While even the most skilled cyberwarriors can’t render their data and operating systems impenetrable against these attacks, cybersecurity professionals and their organizations should engage in constant training and preparation to protect themselves and their organizations from the fallout that commonly follows from a data or systems breach or failure.

The September 17, 2025, “Cybersecurity Jedi Skills Training” workshop that Ms. Stamer will conduct is designed to help CISOs, Directors of Information Security and other leaders strengthen their cybersecurity prevention and response strategies for enhanced defensibility. Drawing from her decades of experience advising and defending data-reliant organizations and their leaders, her workshop will:

Arm cybersecurity leaders with knowledge about how data, systems, and technology can either promote or undermine legal defensibility, and share basic principles and strategies for designing and using technology and data to advance legal goals and defensibility.
Empower cybersecurity defenders with insights into key cybersecurity, privacy, electronic data, and technology-related traps that impact defense and response strategies.
Highlight how cyber events and violations of computer, securities, antitrust, and other laws can expose organizations and their leaders to criminal, civil, and administrative liability.
Reveal key evidentiary practices and processes to use during compliance, contracting, audits, investigations, governance, incident management, and response, as well as when dealing with government or other investigations, to promote and strengthen defensibility and mitigate risks.

Ms. Stamer has developed the training from her decades of experience helping highly regulated and other performance and data-sensitive organizations and their leaders use the law, process, technology and other legal, risk management and operational tools to promote defensibility, mitigate risk, enhance operational effectiveness, and manage change and uncertainty. The founding and Managing Member of the Cynthia Marcotte Stamer, P.C. law firm, Ms. Stamer has used her extensive legal and operational knowledge to provide practical, client-centric advice, tools and solutions to help a diverse array of U.S. and multinational business, government, and community organizations, to design, manage and defend their people; compensation and benefits; technology, data privacy and security; regulatory compliance; and other operations-critical risks and performances for more than 35 years. She is best known for her work with employer and other workforce, health, employee benefits, insurance, data and technology, financial and government organizations, and their technology and other developers and vendors, all of which bear significant data privacy and security obligations.

Longtime Scribe leading the American Bar Association (“ABA”) JCEB Annual Agency Meeting with the HHS Office of Civil Rights; incoming Intellectual Property Section Information Technology Committee Vice Chair, and a widely published author, speaker and thought leader on cybersecurity and other data and technology use, privacy and protection, Ms. Stamer’s process-oriented work throughout her career continuously has included helping clients use and defend their data and technology practices, investigating and responding to data and technology breaches, events, threats and regulations; and dealing with insurers, federal and state legislators, regulators and investigators on cybersecurity and other data and technology concerns. Her cutting-edge work, scholarship and thought leadership, advocacy and community service have earned her recognition as a “Top Woman Lawyer;” “Top Rated Lawyer,” and “LEGAL LEADER™” in Health Care Law and Labor and Employment Law; “Best Lawyer” in “Labor and employment,” “Tax: ERISA & Employee Benefits,” “Health Care,” and “Business and Commercial Law.” For additional information about Ms. Stamer or her services, see here or contact Ms. Stamer directly.

Ms. Stamer’s “Cybersecurity Jedi Skills Training” is part of two days of professional training and networking that ISSA-LA is presenting at its Annual Security Summit 2025. Founded in 1982 by Sandra Lambert and Nancy King, ISSA-LA is the premier catalyst and community resource in Southern California for improving the practice of information security. A 501(c)(3) organization and the founding Chapter of the ISSA®, ISSA-LA provides various training classes and lectures for information Security and IT professionals throughout the year and at the annual Summit. ISSA-LA meets monthly for dinner and regularly collaborates with other IT and Cybersecurity organizations, having joint meetings and social events with the Women’s Society of Cyberjutsu, the Cloud Security Alliance, and the Association of IT Professionals, to name a few. To register, review the schedule, information about sponsorship, or other details about the Annual Security Summit 2025 or ISSA-LA, see here.

For More Information

We hope this update is helpful. For more information about these or other health or other employee benefits, human resources, or health care developments, please contact the author, Cynthia Marcotte Stamer, via e-mail or telephone at (214) 452-8297.

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating in and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

About Solutions Law Press™

Solutions Law Press™ provides health care, insurance, human resources and employee benefit, data and technology, regulatory and operational performance, and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education. These include extensive resources on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press™ resources or training.

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstances at the particular time. No comment or statement in this publication is to be construed as legal advice or admission. Solutions Law Press and its authors reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. Solutions Law Press and its authors disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law-specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2025 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press.™ For information about licensing for republication, please contact the author directly. All other rights reserved.

Leave a Comment » | Corporate Compliance, Cyber crime, data breach, data security, Education, Electronic Medical Records, Emergency Care, FERPA, Genetic Information, Government contractor, Health Apps, Health Care, Health Insurance, Health Plan, HIPAA, Medical Malpractice, NIST | Tagged: ai, Cyber Security, cybersecurity, Security, Technology | Permalink
Posted by Cynthia Marcotte Stamer

OCR’s 8th Investigation Announcement Clearly Warns HHS-Funded Organizations To Ensure Merit-Based Decisions & Manage Antisemitism & Other Prohibited Discrimination Risks

May 14, 2025

Academic medicine and other education, health care, Medicare or Medicaid Advantage insurers, and other organizations received another warning to update and strengthen the defensibility of their policies and practices system-wide for preventing anti-Semitism, and other race, color, national origin, race, religious or other discrimination from the Department of Health & Human Service’s May 13, 2025, announcement of another investigation of another university for anti-Semitism in violation of the Civil Rights Act of 1964 (“CRA”) and other federal civil rights laws.

The Civil Rights Act of 1964 (the “CRA”), the Equal Protection Clause of the 14^th Amendment to the United States Constitution, Section 1557 of the Patient Protection and Affordable Care Act (“Section 1557”) and various other federal laws discrimination on the basis of race, national origin, color and certain other status by covered government or private organizations by health care, Medicare and Medicaid Advantage, academic medicine and other education, child care, research and other HHS-funded organizations, employers and other entities.

Since President Donald J. Trump (“President Trump”) took office in January, HHS OCR, the Departments of Education and Justice, the Equal Employment Opportunity Commission (“EEOC”) and other federal agencies are aggressively investigating anti-Semitism, anti-Christianity, and certain other race, color, national origin and religious discrimination by academic medicine and other educational institutions, health care organizations, health insurers, employers and other organizations covered by these civil rights laws. These investigations and enforcement actions target prohibited discrimination in all forms, including the use of race, national original, color, sex, religion and other non-merit based criteria, even when those criteria are applied to promote racial balancing, diversity or other similar goals.

Trump Merit-Based Civil Rights Executive Orders Heighten Public & Private Civil Rights & Other Discrimination Risks

This heightened investigation and enforcement emphasis is a direct response to the directives of President Trump in a series of Executive Orders directing federal agencies zealously to combat anti-Semitism, anti-Christian, and other discrimination or bias based on race, color, national origin and religion. See e.g., Executive Order 14188 – Additional Measures To Combat Anti-Semitism (January 29, 2025); Executive Order 14202, Eradicating Anti-Christian Bias (February 6, 2025); Executive Order 14291, Establishment of the Religious Liberty Commission (“May 11, 2025); and Executive Order 14291, Establishment of the Religious Liberty Commission (May 1, 2025).

As part of these directives, President Trump specifically singled out anti-Semitism for special attention and concern, In Executive Order 14188, for instance, President Trump directed HHS, the Justice Department and other agencies to vigorously enforce the Civil Rights Act to combat the rise of anti-Semitism and anti-Semitic incidents in the U.S. and around the world. While Executive Order 14188 specifically targeted the use of the Civil Rights Act and other federal prohibitions against race, color and national origin discrimination to fight anti-Semitism, Executive Order 14188 also noted that anti-Semitism also can violate federal protections against religious discrimination, stating:

…[Title VII] prohibits discrimination on the basis of race, color, and national origin in programs and activities receiving Federal financial assistance. While Title VI does not cover discrimination based on religion, individuals who face discrimination on the basis of race, color, or national origin do not lose protection under Title VI for also being a member of a group that shares common religious practices. Discrimination against Jews may give rise to a Title VI violation when the discrimination is based on an individual’s race, color, or national origin.

The Trump Administration’s emphasis on protecting federal right of conscience and other religious freedom protections is made more perilous by his sharp disagreement, revocation, and characterization as patently illegal various key aspects of the interpretation and enforcement policies of the Biden, Obama and other previous administration regarding federal right of conscience and other religious freedom, sexual orientation, reproductive rights and other civil rights policies and protections. See e.g., Executive Order 14281 -Restoring Equality of Opportunity and Meritocracy (April 23, 2025). These directives and widespread coverage and publicity of the actions by HHS and other federal agencies to implement and enforce the Administration’s Merit Based interpretation and enforcement of civil rights laws are fueling a a slew of new federal investigations and enforcement, as well as encouraging and shaping private discrimination claims by both parties advantaged or disadvantaged by the Administration’s interpretations.

As reflected by OCR’s May 13, 2025 announcement of its investigation of complaints against a “prestigious” midwestern university (“University”), OCR and other federal agencies are responding by zealously investigating complaints of anti-Semitism or other race, color, national origin and religious discrimination by academic and other health care, education, health insurance and other organizations receiving federal funding under programs managed by HHS.

Announced OCR Investigations Since February Show HHS Enforcement Risks

According to OCR, the investigation announced on May 13, 2025, and other investigations “[are] part of a broader effort by the Administration’s multi-agency Joint Task Force to Combat Anti-Semitism. OCR opened the investigation against the University in response to a complaint from a multi-stakeholder advocacy organization that alleges “systemic concerns regarding the University’s actions to maintain a campus climate, academic direction, and institutional policy that ensures nondiscrimination on the basis of race, color, and national origin.” OCR says its investigation will examine whether the University complied with its obligations under Title VI not to discriminate against Jewish students, such that it denied them an educational opportunity or benefit.

Before OCR issued is May 13, 2025, announcement, OCR and other federal agencies previously had announced Civil Rights Act and other investigations of illegal anti-Semitism at four academic medical centers based on their response to protests and other anti-Semitic activity during graduation and other activities. In addition, OCR also had announced similarly high-profile investigation or enforcement actions against Harvard University and Harvard Law Review, a HHS-funded health services research scholarship program; eight medical schools and hospitals; a HHS-funded health research program; a California-based medical school; the State of Maine and others for impermissibly applying race, color, national origin, sex, religious or other prohibited criteria in operating their programs.

The message from these and other HHS investigations and enforcements is clear. “Institutions of higher education receiving HHS Federal financial assistance are responsible for complying with Title VI’s nondiscrimination mandates,” said Anthony Archeval, Acting Director of the Office for Civil Rights at HHS. “OCR is committed to ensuring students’ education, safety, and well-being are not disrupted due to discrimination at institutions funded by taxpayer dollars.”

Dear Colleague Letter Advises Academic Medicine & Other HHS-Funded Organizations On Implementing Merit Based Decisionmaking

While warning academic medical and other health care and other HHS-funded organizations against the application of non-merit based criteria and other prohibited race, national origin, color, sex and religious discrimination, OCR also has sought to encourage covered entities to adapt their policies and practices to comply with President Trump’s merit based interpretation of the Civil Rights Act and other federal civil rights law prohibitions against race, color, national origin, sex and religious discrimination through a May 6, 2025, “Dear Colleague” Letter. In the dear Colleague Letter, OCR ‘clarifies’ its updated policies interpreting and enforcing what constitutes race-based discrimination under Title VI, Section 1557, and the Equal Protection Clause of the United States Constitution as applied to student admissions, academic and campus life, and the operation of university hospitals and clinics.

The Dear Colleague Letter reiterates that Title VI and Section 1557 prohibit academic medical and other covered organizations from relying on race-based criteria, racial stereotypes, and facially neutral criteria that operate as a pretext for race. Instead, citing to the Supreme Court’s decision in Students for Fair Admissions v. Harvard, 600 U.S. 181 (2023) and President Trump’s Executive Order 14173, Ending Illegal Discrimination and Restoring Merit-Based Opportunity, the Dear Colleague Letter warns HHS funded academic medicine and other organizations that these federal rules require health care providers, and those in the health professions pipeline make their selections and decisions “based on merit and clinical skills, not race” or other non-merit based criteria even when the purpose of the use of the criteria is to promote diversity or racial-balancing.

The Dear Colleague Letter discloses that in applying its merit-based interpretation of Title VI and Section 1557, OCR will prioritize enforcement against HHS funded organizations that:

Use race as part of their application or employment processes;

Require diversity, equity, and inclusion statements in connection with hiring or promotion; or
Lack clear policies demonstrating compliance with Students for Fair Admissions v. Harvard.

Accordingly, the Dear Colleague Letter advises medical schools and other HHS-funded organizations to:

Ensure their policies and procedures comply with existing federal civil rights laws;
Discontinue criteria, tools, or processes that serve as substitutes for race or are intended to advance race-based decision-making; and
End reliance on third-party contractors, clearinghouses, or data aggregators that engage in prohibited uses of race.

Act Now To Mitigate Risks From Past, Current & Future Non-Merit Based Decisions & Other Prohibited Discrimination

The new emphasis of HHS and other agencies on investigation and enforcement of federal protections for race, national origin, and other civil rights laws alone should prompt all health care and other HHS-regulated authorities prospectively to reevaluate and update their own practices to strengthen their defensibility under new standards.

As the Trump Administration civil rights directives and interpretations apply to all federal agencies, all organizations should consider and redress their exposure to civil rights or other discrimination under EEOC and other workforce, Department of Justice, and other applicable agency rules when assessing the adequacy of their existing policies and practices.

Organizations also should anticipate the likely need to defend past actions taking into account given the practice of HHS and other agency to apply the merit-based civil rights law interpretations of the Trump Administration even to events and actions that occurred while organizations were subject to the diversity, equity and inclusion friendly interpretations of federal civil rights laws during the Biden Administration. Since the investigation and enforcement actions announced by HHS and other agencies so far retroactively apply the newly announced Trump-era interpretations and standards to investigations of events and actions that occurred during the Biden Administration, prospective changes to enhance the defensibility of current and future actions alone may not be enough. Rather, health care and other organizations need to prepare for the possibility that HHS or other agencies may require their organization to defend Biden-era events under the new Trump Administration interpretations and enforcement policies. In the face of these developments, all health care organizations receiving funding from HHS should review their current and past policies and actions implicating federally civil rights laws to assess and manage their potential past exposures and mitigate future risks.

Because the process of reviewing and revising their policies and practices inevitably will require medicine and other HHS-funded institutions to identify and engage in legally and politically sensitive discussions of past and current policies, events, and actions affecting the competing interests of individuals or organizations whose opportunities are either helped or hurt by the Trump Administration’s transition to a merit-based interpretation of civil rights laws as well as potential whistleblower and retaliation exposures, academic medicine and other HHS-funded organizations generally should work with within the scope of attorney-client privilege with legal counsel experienced with these and other civil rights laws and dealing with OCR and other agencies in relation to investigations and enforcement actions under these rules.

The author of this update, Cynthia Marcotte Stamer has decades of experience advising, representing, and defending health care providers, Medicare and Medicaid Advantage and other public and private health plans and plan sponsors, public and private employers, government contractors and grant recipients, educational organizations, child care facilities, employers, technology, data, third party administrators, and other managed care and other health care, defense, technology, life sciences and other clients about Civil Rights Laws and other religious, civil rights and other discrimination, HIPAA and other privacy and data security, False Claims Act and other billing and reimbursement, quality, technology, licensing and accreditation, whistleblower and other workforce, enforcement, governmental affairs, dispute resolution, and other compliance, risk management and operational matters. If you have questions or need advice or help evaluating or addressing these or other compliance, risk management, or other concerns, contact her.

For More Information

We hope this update is helpful. For more information about the or other health or other employee benefits, human resources, or health care developments, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452-8297.

About the Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for her more than 35 years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications including leading edge work on workforce and other risk management and compliance.

In addition, Ms. Stamer serves as a Scribe for the American Bar Association (“ABA”) Joint Committee on Employee Benefits annual agency meetings with OCR and shares her thought leadership as International Section Life Sciences Committee Vice Chair, and a former Council Representative, Past Chair of the ABA Managed Care & Insurance Interest Group, former Vice President and Executive Director of the North Texas Health Care Compliance Professionals Association, past Board President of Richardson Development Center (now Warren Center) for Children Early Childhood Intervention Agency, past North Texas United Way Long Range Planning Committee Member, and past Board Member and Compliance Chair of the National Kidney Foundation of North Texas, and a Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also shares her extensive publications and thought leadership as well as leadership involvement in a broad range of other professional and civic organizations.

Author of many highly regarded compliance, training and other resources on cybercrime and other data privacy and security, health and other employee benefits, health care, insurance, workforce and other risk management and compliance, Ms. Stamer is widely recognized for her thought leadership and advocacy in these matters.

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides health care, human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on health care, leadership, governance, human resources, employee benefits, data security and privacy, insurance, and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press, Inc.™ resources including the following recent publications about related emerging developments:

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstances at the particular time. No comment or statement in this publication is to be construed as legal advice or admission. The author reserves the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. The author and Solutions Law Press, Inc. disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law-specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Leave a Comment » | Academic medicine, Child Care, Childcare, Civil Rights, Conditions of Participation, Cultural diversity, dei, Direct Primary Care, Disability Discrimination, Discrimination, early childhood education, Education, Employee Benefits, Employer, Employment, Federal Health Center, Government contractor, Grant recipients, Grants, Health Care, Health Care, Health Care Finance, Health Care Provider, Health Insurance, Health Insurance Exchange, Health Plan, Health Plans, healthcare, Heath Care Exchange, HHS, Home Health, home health, Hospice, Hospital, Hospital, hospitals, Medicaid, Medicaid Advantage, Medical Licensure, Medicare, Medicare Advantage, Medicare Advantage, OCR, OCR, Patients, Pharmaceudical, Reproductive Rights, Rural Health Care, Section 1557, University, Veterans Health | Tagged: Civil Rights, donald-trump, Education, Merit-Based, news, politics, Trump | Permalink
Posted by Cynthia Marcotte Stamer

$11 Million False Claims Act Cybersecurity Settlement Reminds Health Plas HIPAA Isn’t Only Cyberbreach Exposure

March 17, 2025

The more than $11 million Health Net Federal Services Inc. (“HNFS”) and its corporate parent Centene Corporation, have agreed to pay under a settlement resolving claims that HNFS falsely certified compliance with cybersecurity requirements in a contract with the U.S. Department of Defense (“DoD”) reminds health industry organizations that Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) is only one of many federal statutes under which their organizations and their leaders can incur liability for cybersecurity breaches or other deficiencies. As the HNFS settlement makes clear, for instance, HIPAA Entities and other businesses that violate conditions of participation or contractual requirements for federal program participation also risk potential significant liability for deficiency in their compliance with data security, privacy or other cybersecurity requirements of those programs.

HIPAA Important But Not Only Cyber Liability Risk For Health Industry Organizations

Most health care providers, health insurers and other health plans, healthcare clearinghouses (“Covered Entities”) and their business associates (collectively, “HIPAA Entities”) recognize the importance of complying with the national standards for the protection of individuals’ electronic protected health information (“ePHI”) set forth in HIPAA Privacy, Security, and Breach Notification Rules (the “HIPAA” Rules”) to minimize or avoid painful civil monetary penalties or even criminal liability HIPAA authorizes for violations of HIPAA.

While the lengthy and growing list of HIPAA civil monetary penalties and resolution agreements obtained by the Department of Health and Human Services (“HHS”) Office of Civil Rights found to have violated the Security or other requirements of the HIPAA Rule shows the continued importance for HIPAA Entities to maintain HIPAA compliance, enforcement actions like the HNFS drive home that HIPAA Entities should not ignore other important cybersecurity obligations arising from the cybersecurity requirements created under terms of participation applicable to federal programs, or other applicable laws or statutes.

HNFS False Claims Act Cyber Liability Settlement

The HNFS enforcement action and settlement reveals False Claims Act liability as another significant cyber liability risk for health care providers, health care exchange insurers, Medicare Advantage, Medicaid Advantage, SCHIP, TRICARE and other military health, health technology, and other health industry organizations and their business associates and other subcontractors, who are government contractors or grant recipients.

The Justice Department previously has warned federal contractors that failing to fulfill or falsely certifying their compliance with required cybersecurity standards applicable to their contracts or programs could expose them to civil liability for violation of the False Claims Act^[1] (“FCA”). On October 6, 2021, then Deputy Attorney General Lisa O. Monaco announced a Civil Cyber-Fraud Initiative would use the FAC to hold accountable government contractors and grant recipients that put U.S. information or systems at risk by knowingly providing deficient cybersecurity products or services, knowingly misrepresenting their cybersecurity practices or protocols, or knowingly violating obligations to monitor and report cybersecurity incidents and breaches applicable to their federal contracts or programs.

To violate the FCA, the government contractor or other accused person must have submitted, or caused the submission of, the false claim or made a false statement or record with knowledge of the falsity. Under Section 3729(b)(1), knowledge of false information is defined as being (1) actual knowledge, (2) deliberate ignorance of the truth or falsity of the information, or (3) reckless disregard of the truth or falsity of the information.

The Department of Justice obtained more than $2.9 billion in settlements and judgments from civil cases involving fraud and false claims against the government in the fiscal year ending Sept. 30, 2024. Under the FCA, government contractors or other persons violating the FCA generally are liable to pay the United States three times the government’s damages plus a penalty that is linked to inflation for knowingly submitting or causing another to submit a false claim to the government; making a false record or statement to get a false claim paid by the government; acting improperly to avoid having to pay money to the government; or conspiring to violate the FCA. In addition to allowing the United States to pursue FCA violations on its own, the FCA allows private citizens to file “qui tam” suits on behalf of the government against violators of the FCA. Private citizens who successfully bring qui tam actions may receive a portion of the government’s recovery. Many Justice Department FCA and other fraud investigations and lawsuits arise from such qui tam actions.

While the Justice Department’s announcement of the HNFS settlement did not expressly reference the Civil Cyber-Fraud Initiative, the action and statements made by Justice Department officials in connection with its announcement reflect that the Justice Department remains committed to using the False Claims Act to hold federal government health care and other contractors, subcontractors, and grant recipients accountable for failing to comply with applicable federal cybersecurity requirements.

Beginning in 2010, HNFS contracted with the DOD to provide managed healthcare support services for the TRICARE program in approximately 22 states. The support services included administrative support services, provider network development, referral management, enrollment support, and claims processing services. In 2016, Centene succeeded to these contractual obligations when it acquired all of the shares of Health Net Inc., HNFS’s corporate parent, and assumed the liabilities of HNFS. Consistent with applicable conditions for participation in the program, HNFS’s contract with the DOD required HNFS to comply with DOD data security and privacy requirements and to periodically certify that compliance.

The TRICARE contract required HNFS to “provide information management and information technology support as needed to accomplish the stated functional and operational requirements of the TRICARE program” and to adhere to certain privacy standards and cybersecurity requirements, including but not limited to 48 C.F.R. § 252.204-7012 and 51 security controls listed in the National Institute of
Standards and Technology Special Publication 800-53 (NIST 800-53), Security and Privacy Controls for Information Systems, Revision 4. The annual certification requirement included in the contract also required HNFS annually to certify both compliance with the standards and “that the security controls required by the contract are implemented correctly, operating as intended, and support the security policies of the Defense Health Agency.”

The settlement resolves DOD and Justice Department allegations that, between 2015 and 2018, HNFS failed to provide the cybersecurity controls required under its contract. Specifically, Justice Department charged that:

HNFS failed to timely scan for known vulnerabilities and remedy security flaws on its networks and systems, in accordance with its System Security Plan and response times established by HNFS;
HNFS ignored reports from third-party security auditors and its internal audit department of cybersecurity risks on HNFS’ networks and systems related to asset management; access controls; configuration settings; firewalls; end-of-life hardware and software in use; patch management (i.e., installing critical security updates released by vendors to counter known threats); vulnerability scanning; and password policies; and
HNFS falsely attested to DHA that it was in compliance with at least seven of the NIST 800-53 security controls listed in the NIST Compliance Certifications when it submitted those certifications to DHA

The Justice Department and DOD also charged HNFS with falsely certifying compliance with these controls in annual reports to DHA that were required under its contract to administer the TRICARE program.

As a result of these deficiencies, the Justice Department and Department of Defense claimed that HNFS’ claims for reimbursement under the Tricare contract were false, regardless of whether there was any exfiltration or loss of servicemember data or protected health information.

To resolve the alleged False Claims Act liability asserted by the government, HNFS and Centene Corporation agreed to pay $11,253,400 to the Department of Justice. The settlement agreement also expressly reserves the United States’ right to pursue any criminal charges arising from the conduct and limits HNFS and Centene from raising the settlement as a bar to any such criminal charges.

Statements made by Justice Department officials in its announcement of the HNFS settlement signal that the Justice Department remains committed to using the False Claims Act to hold government contractors and other recipients of federal funds accountable for failing to comply with cybersecurity requirements of their contracts.

The press release announcing the settlement quotes Acting Assistant Attorney General Brett A. Shumate, head of the Justice Department’s Civil Division as warning, “We will continue to pursue knowing violations of cybersecurity requirements by federal contractors and grantees to protect Americans’ privacy and economic and national security.”

Meanwhile, Cyber Field Office Special Agent in Charge Kenneth DeChellis of the Defense Criminal Investigative Service (DCIS), the law enforcement arm of the DoD Office of Inspector General also is quoted as stating, “DCIS will not be deterred from investigating contractors that fail to comply with federal cybersecurity requirements and risk exposing protected information vulnerable to criminal hackers. The U.S. taxpayers who fund these government contracts expect no less.”

Taken together with the HNFS enforcement action and resulting settlement, these statements provide a strong warning for health industry and other government contractors that their failure to comply with cybersecurity requirements in their federal contracts or grants could lead to prosecution under the False Claims Act in addition to otherwise applicable liabilities arising under HIPAA or other federal or state laws. Accordingly, health care organizations; Medicare, Medicaid, SCHIP, TRICARE and Federal Health Insurance Exchange program contractors; and other federal government contractors, subcontractors and grant recipients also should ensure their ability to defend their ongoing compliance with any data security, privacy or other federal cybersecurity requirements to guard against potential False Claims Act liability for noncompliance with these contractual responsibilities.

The author of this update, Cynthia Marcotte Stamer is an American College of Employee Benefits Counsel Fellow and attorney board certified in Labor and Employment Law by the Texas Board of Legal Specialization, who has decades of experience advising health care providers, Medicare and Medicaid Advantage and other public and private health plans and plan sponsors, government contractors and grant recipients, and their technology, data, third party administrators, and other managed care and other health care, defense, technology, life sciences and other clients about HIPAA and other protected health information, trade secret, personal information and other cybersecurity and other data and systems use, protection, andthese and other federal and state program design, contracting, quality, technology, reimbursement, licensing and accreditation, compliance, enforcement, governmental affairs, dispute resolution, and other compliance, risk management and operational matters. If you have questions or need advice or help evaluating or addressing these or other compliance, risk management, or other concerns, contact her.

For More Information

About the Author

Ms. Stamer’s work throughout her career has focused heavily on working with health care, health insurance and managed care, insurance and financial services, defense contractors, and other workforce and data sensitive businesses domestically and internationally on employment, benefits, data and other knowledge use and protection, Federal Sentencing Guidelines and other workforce and heath care management, internal and operational controls, regulatory and public policy and other legal and operational concerns. As a part of this work, she has had extensive involvement in the design, enforcement, investigation, mitigation and defense of trade secret and other information privacy and confidentiality, HRIS, claims, electronic medical records, payment, and other systems and technologies; HIPAA and other health industry, DOD, FACTA, GLB, EU, and other data privacy and security, trade secret and other confidential information; and other information privacy and security laws, policies, practices, contracts and requirements.

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press, Inc.™

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstances at the particular time. No comment or statement in this publication is to be construed as legal advice or admission. The author reserves the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. The author and Solutions Law Press, Inc. disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law-specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

[1]31 U.S.C. §§ 3729 – 3733.

Leave a Comment » | CHIP, Cyber crime, data breach, data security, Department of Defense, DOD, false claims act, Government contractor, Grant recipients, Health Care, Heath Care Exchange, HHS, HIPAA Cyber Crime, Medicaid Advantage, Medicare Advantage, TRICARE | Tagged: cybersecurity, Health Care, Health Care Fraud, healthcare, HIPAA, Hospital, Medicare, Physician, Security, Technology | Permalink
Posted by Cynthia Marcotte Stamer

One Door for Criminal Health Care Fraud Disclosures: DOJ’s Fraud Division and HHS-OIG Consolidate Self-Disclosure—and Close the SDP to Criminal Conduct

What the Joint Policy Does

Important Limits Buried in the Footnotes

What Changed in the Updated HHS-OIG SDP

The Parallel Civil Track: The DOJ–HHS FCA Self-Disclosure Pilot Program

Why the Timing Matters: A Rapidly Escalating Enforcement Environment

Analysis: The Hard Part Is the Triage

Action Items by Stakeholders

Bottom Line

For Help or More Information

About the Author

About Solutions Law Press, Inc.™

Share this:

CMS Imposes Nationwide Enrollment Moratoria on Hospices and Home Health Agencies; Issues New Medicaid State Directed Payment Limits

BACKGROUND

NATIONWIDE MEDICARE ENROLLMENT MORATORIA: HOSPICES AND HOME HEALTH AGENCIES

Legal Authority

Scope and Effective Date

Rationale: Data-Driven Findings

Applicability to Medicaid and CHIP

Accompanying Enforcement Intensification

Moratorium Termination

Appeals

CMS GUIDANCE ON MEDICAID STATE DIRECTED PAYMENT LIMITS

Overview

New Payment Limits

Grandfathering

Next Steps for States

IMPLICATIONS FOR PROVIDERS

For Currently Enrolled Providers

For Providers Seeking New Enrollment

For Transactions Involving Ownership Changes

For Organizations Participating in Medicaid Managed Care SDPs

Patients and Their Caregivers

For Help or More Information

About the Author

About Solutions Law Press, Inc.™

Share this:

Stamer “Cybersecurity Jedi Skills Training” Added To 2025 Security Summit Agenda

About Solutions Law Press™

Share this:

OCR’s 8th Investigation Announcement Clearly Warns HHS-Funded Organizations To Ensure Merit-Based Decisions & Manage Antisemitism & Other Prohibited Discrimination Risks

Trump Merit-Based Civil Rights Executive Orders Heighten Public & Private Civil Rights & Other Discrimination Risks

Announced OCR Investigations Since February Show HHS Enforcement Risks

Dear Colleague Letter Advises Academic Medicine & Other HHS-Funded Organizations On Implementing Merit Based Decisionmaking

Act Now To Mitigate Risks From Past, Current & Future Non-Merit Based Decisions & Other Prohibited Discrimination

For More Information

About the Author

About Solutions Law Press, Inc.™

Share this:

$11 Million False Claims Act Cybersecurity Settlement Reminds Health Plas HIPAA Isn’t Only Cyberbreach Exposure

HIPAA Important But Not Only Cyber Liability Risk For Health Industry Organizations

HNFS False Claims Act Cyber Liability Settlement

For More Information

About the Author

About Solutions Law Press, Inc.™

Share this:

Recent Posts

Archives

About Cynthia Marcotte Stamer

Share this blog

Archives

Solutions Law Press Health Care Update