Lincoln's Law Is
Coming for Your Billing
The False Claims Act — the government's most powerful anti-fraud weapon since 1863 — is now targeting healthcare cybersecurity failures, not just billing fraud. If you submit claims to Medicare or Medicaid, this affects you today.
What Every Healthcare SMB Must Understand About the False Claims Act
Enacted in 1863 to combat Civil War contractor fraud, the False Claims Act has evolved into the U.S. government's single most effective tool for recovering taxpayer money. In healthcare alone, it has transformed from a billing-fraud statute into a sweeping compliance mandate that now reaches deep into your IT infrastructure.
The FCA imposes civil liability on anyone who knowingly submits — or causes to be submitted — a false claim for government payment. "Knowing" is defined broadly: actual knowledge, deliberate ignorance, or reckless disregard of the truth. No specific intent to defraud is required. This means an executive who "chose not to ask" about compliance gaps is not shielded from liability.
Financial Consequences at a Glance
Any employee, contractor, or agent who reports fraud to the government is protected from retaliation. If demoted, harassed, or terminated, they can recover reinstatement, double back pay with interest, and special damages plus attorney's fees. This means a disgruntled IT employee who witnessed a covered-up vulnerability scan has every financial and legal incentive to file a qui tam complaint.
Cybersecurity Is Now a Condition of Payment
In 2021, the DOJ formally declared that cybersecurity compliance failures by healthcare entities receiving federal payments are FCA violations. If you bill Medicare or Medicaid and your security certifications are inaccurate — even if no breach occurred — you may be liable for every single claim you submitted while out of compliance.
The DOJ's theory is straightforward and devastating for unprepared organizations: your annual cybersecurity compliance certification is not a formality — it is a material representation to the government. If the government would not have paid your claims had it known the truth about your security posture, those claims are legally "false" from the moment they were submitted.
Under Universal Health Services v. Escobar (2016), a misrepresentation is "material" if it would have influenced the government's payment decision. The DOJ's position is that known, unfixed cybersecurity failures are material — meaning the government would not have paid had it known. Every Medicare claim submitted during a period of non-compliance is potentially a separate false claim.
High-Profile Settlements: Lessons for SMBs
Five Cybersecurity Obligations the DOJ Enforces
Healthcare companies must include explicit cybersecurity clauses in all Business Associate Agreements (BAAs) and actively audit vendor compliance. If your billing vendor, EHR provider, or cloud host suffers a breach due to inadequate security, the DOJ may look upstream to the covered entity. In M&A transactions, acquiring firms can face successor liability for the predecessor organization's cybersecurity failures discovered post-acquisition.
The Specific Controls DOJ Investigators Look For
In recent FCA settlements — including Verizon, Illumina, and Health Net — the DOJ cited failures against specific NIST SP 800-171 controls. These are the five categories most commonly cited in civil cyber-fraud investigations. If any of the "common failures" described below exist in your environment, you may already be at risk.
| Control Category | NIST 800-171 Requirement | Common Failure |
|---|---|---|
| Access Control | 3.1.3 CUI Flow Control | ⚠ High Risk Allowing sensitive data (CUI/ePHI) to flow to unauthorized external systems, including unsanctioned cloud storage or third-party apps. |
| Identification & Authentication | 3.5.3 Multi-Factor Authentication | ⚠ High Risk Failing to enforce MFA for local or remote network access — particularly on legacy systems, VPNs, and administrative portals. |
| Audit & Accountability | 3.3.4 Audit Log Failure Alerting | ⚠ High Risk Not logging, monitoring, or reviewing security events in real-time. Log gaps are a primary indicator of concealed breaches during DOJ CID investigations. |
| Configuration Management | 3.4.1 Baseline Configuration | ⚠ Critical Using default vendor credentials, factory settings, or hard-coded passwords in production systems — the exact failure cited in the Illumina and Penn State cases. |
| System & Info Integrity | 3.14.1 Flaw Remediation | ⚠ Critical Failing to identify and patch system flaws within required timeframes — especially CISA emergency directives (e.g., Log4j, Exchange vulnerabilities) while continuing to bill federal payers. |
Note: While the Verizon settlement specifically cited TIC 2.2 architecture failures (DNSSEC, full packet capture, FIPS 140-2 encryption), and Illumina was cited for System and Services Acquisition (SA) and Incident Response (IR) failures, the five NIST controls above represent the baseline enforcement floor that DOJ investigators expect all healthcare entities handling federal data to demonstrate.
The 5 Red Flags That Put You in the DOJ's Crosshairs
When a whistleblower files a qui tam complaint under the Civil Cyber-Fraud Initiative, the DOJ screens it against a framework of "material" failures. These are the five patterns that most reliably escalate a complaint into a formal DOJ investigation — and ultimately an FCA settlement or judgment. Click each to expand.
The DOJ issues Civil Investigative Demands to seize: Slack/Teams communication logs between IT staff discussing vulnerabilities; prior audit reports (SOC 2, HITRUST, penetration tests) that may have been suppressed or misrepresented; and critically — cyber insurance applications, where companies typically provide more accurate (and often contradictory) security disclosures than in their government certifications. The DOJ specifically compares your insurance application against your government certifications to identify discrepancies.
Building Your "Defensive File" Against DOJ Investigation
The DOJ evaluates whether your cybersecurity certifications were objectively reasonable at the time they were made. The best defense is not perfection — it is a documented, audit-ready evidence trail demonstrating good-faith compliance efforts. Use the checklist below to assess your organization's readiness.
FCA TEKCHEK: Your Exposure Profile
Answer these five questions honestly. This tool is a starting point for reflection — not legal advice. If your results indicate elevated risk, consult a qualified healthcare compliance attorney or cybersecurity advisor immediately.
Select the answer that most accurately describes your current situation.
Don't Wait for a Civil Investigative Demand
The DOJ doesn't announce investigations in advance. By the time you receive a CID, your Slack logs, audit reports, and insurance applications are already being compared against your government certifications. The time to build your defensive file is now.