Toolkit · Healthcare

The Healthcare Law Toolkit

42 U.S.C. § 1320

Type
Toolkit
Jurisdiction
National
Date
2026-07-07
Topic
Healthcare

Healthcare is the most heavily regulated industry in the American economy, and the rules come from everywhere at once: federal fraud-and-abuse statutes, federal privacy law, state licensing boards, state corporate-practice-of-medicine doctrine, payer contracts, and accreditation bodies. This toolkit is a resource map, not a treatise. It walks eleven pillars — entity structure, licensing, HIPAA, the Anti-Kickback Statute, the Stark Law, the False Claims Act, billing and reimbursement, compliance programs and self-disclosure, telehealth and clinical AI, healthcare employment, and government investigations — and for each one gives you the plain-English doctrine, the anchor authority, the traps that actually generate enforcement, and the deeper UpLaw guides and checklists to work from. A running example, a fictional multi-site clinic called Rivermark Health Partners, carries the thread from formation through a federal subpoena. Use the gated checklist at the end as your standing agenda.

The Healthcare Law Toolkit

Healthcare > Healthcare Compliance | Published 7 July 2026 - Updated 4 August 2026 | UpLaw - uplaw.us

Most industries have a compliance function. Healthcare has a compliance function because the alternative is a criminal statute. The distance between a sloppy referral arrangement and a False Claims Act complaint is measured in emails, not in years.

Keywords: healthcare compliance, HIPAA, Anti-Kickback Statute, Stark Law, False Claims Act, qui tam, corporate practice of medicine, billing compliance, OIG guidance, self-disclosure, telehealth, clinical AI, exclusion, government investigation

How to read this toolkit

This is a map, not the territory. Each of the eleven pillars below gives you three things: the doctrine in plain English, the anchor authority you should be able to name from memory, and pointers to the UpLaw documents that go deep. Read it in one of three ways.

If you are standing up a healthcare business, read Pillars 1, 2, 3, and 8 first. Structure, licensure, privacy, and a compliance program are the load-bearing walls. Everything else is finish work you can add as revenue arrives.

If you already operate and want to know where you are exposed, read Pillars 4 through 7 — Anti-Kickback, Stark, the False Claims Act, and billing. This is where enforcement lives. Nearly every headline healthcare settlement traces back to a referral relationship that was never papered, a compensation formula that varied with volume, or a code that was upgraded a little too consistently.

If something has already gone wrong — a subpoena, a Civil Investigative Demand, a hotline call, an OCR letter — go straight to Pillar 11, then double back to Pillar 8 for self-disclosure.

Three orientation points before we start.

First, healthcare law is federal and state at once. HIPAA, the Anti-Kickback Statute, the Stark Law, and the False Claims Act are federal, and what this toolkit says about them applies nationwide. Almost everything else here is state law that varies substantially: licensure and scope of practice, medical records, professional entity law, fee-splitting, the corporate practice of medicine doctrine, physician non-competes, insurance regulation and coverage, and unfair-and-deceptive-practices (UDAP) statutes. There is no national rule on any of those subjects. This toolkit teaches the framework, names representative states as illustrations only, and expects you to confirm your own state's rule before you rely on anything.

Second, corporate law is state law, and Delaware is this toolkit's reference point. When we discuss board oversight duties, fiduciary standards, and the Caremark line of oversight liability, we are describing Delaware doctrine — because Delaware is where most PE-backed healthcare holding companies are incorporated and because its case law is the most developed. Other states frequently follow Delaware, but they are not required to, and several diverge in meaningful ways. If your entity is organized elsewhere, treat Delaware as the leading persuasive model, not as the governing law.

Third, compliance is not a document. It is a set of behaviors that produce documents. A binder no one reads is an exhibit for the government, not a defense.

Our running example: Rivermark Health Partners, a fictional four-site primary care and imaging group in a state that enforces the corporate practice of medicine doctrine strictly. Rivermark is physician-founded but private-equity-backed, bills Medicare and commercial payers, runs an in-house MRI, and has just launched a telehealth line with an AI triage assistant. Rivermark will make most of the mistakes in this toolkit so you do not have to.

The healthcare compliance landscape at a glance

Pillar The core question Anchor authority
1. Entity structure Who is legally permitted to own the practice? State corporate practice of medicine doctrine; state professional entity statutes
2. Licensing & credentialing Is every person practicing lawfully, in this state, in this scope? State medical practice acts; payer and hospital credentialing rules
3. HIPAA Who touches PHI, under what safeguards, and what happens when it leaks? 42 U.S.C. § 1320d et seq.; 45 C.F.R. Parts 160, 164
4. Anti-Kickback Is anyone being paid, in any form, for referrals? 42 U.S.C. § 1320a-7b(b)
5. Stark Does a physician have a financial relationship with an entity they refer to? 42 U.S.C. § 1395nn
6. False Claims Act Did a false or non-compliant claim reach a federal payer? 31 U.S.C. §§ 3729–3733
7. Billing & coding Does the documentation support the code? 42 C.F.R. Part 424; CPT/ICD-10 rules; NCCI edits
8. Compliance program Can you detect and fix your own problems? OIG Compliance Program Guidance; U.S.S.G. § 8B2.1
9. Telehealth & AI Where is the patient, who is licensed, and what is the algorithm doing? State licensure law; 21 U.S.C. § 829(e); 21 U.S.C. § 360j(o)
10. Employment Are clinicians and staff classified, paid, and restricted lawfully? FLSA, 29 U.S.C. § 201 et seq.; state non-compete law
11. Investigations Who is asking, what do they want, and what must you preserve? 31 U.S.C. § 3733; 42 U.S.C. § 405(d); Fed. R. Crim. P. 17

For the full doctrinal treatment of the three fraud-and-abuse pillars, work from Healthcare Compliance: A Comprehensive Guide to HIPAA, Stark, and the Anti-Kickback Statute. This toolkit is the index to it and to everything around it.

Pillar 1 — Entity structure and the corporate practice of medicine doctrine

The doctrine. In a majority of states, a general business corporation or an ordinary LLC may not employ physicians to practice medicine or share professional fees with them. The prohibition — the corporate practice of medicine (CPOM) doctrine — is a creature of state law, arising from medical practice acts, professional-entity statutes, and attorney-general opinions rather than from any federal source. Its purpose is to keep clinical judgment insulated from lay commercial pressure.

Enforcement intensity varies enormously. California and Texas are famously strict; California's Medical Practice Act (Cal. Bus. & Prof. Code § 2400) bars corporations from practicing medicine, and professional corporations are governed by the Moscone-Knox Professional Corporation Act (Cal. Corp. Code § 13400 et seq.). New York channels professional practice through professional service corporations under Business Corporation Law Article 15 and PLLCs under Limited Liability Company Law Article 12. Other states barely enforce the doctrine at all. Never assume a nationwide rule here — confirm your state.

The standard workaround. The "friendly PC" / MSO model: a professional corporation owned by a licensed physician employs the clinicians and holds the clinical relationship; a management services organization, which may be owned by lay investors, provides everything else — billing, HR, real estate, technology, marketing — under a long-term management services agreement. The MSA must be priced at fair market value, must not be a percentage of professional fees in states that treat that as fee-splitting, and must leave genuine clinical control with the PC.

The trap. The trap is that the MSA is drafted to be so comprehensive that the "friendly" physician owner is a figurehead. If the MSO hires and fires the clinicians, sets protocols, controls the charts, and holds a stock transfer restriction agreement that lets it swap the physician owner at will, a regulator or a plaintiff's lawyer will argue the PC is a sham. Fee-splitting and CPOM claims increasingly surface not in board proceedings but as payer clawbacks, state unfair-and-deceptive-practices (UDAP) claims, and unclean-hands defenses in contract litigation — which is often worse. Note that UDAP statutes are state statutes: their elements, their remedies (some allow treble damages and fees), and whether they reach regulated healthcare conduct at all differ state by state, and several states exempt conduct that is otherwise regulated. There is no federal UDAP cause of action for a private plaintiff.

Rivermark: Rivermark's PE sponsor wants board control. Counsel builds a PC owned by Dr. Alvarez, an MSA at a flat fee plus a cost-plus component, and a succession agreement that transfers the PC only to another licensed physician. Clinical protocols, hiring of clinicians, and utilization decisions stay with the PC's medical director. The sponsor gets economics; the PC keeps medicine.

Entity mechanics, board formalities, and the fiduciary duties that PE-backed healthcare boards routinely under-observe are covered in Corporate Governance and Fiduciary Duties: A Comprehensive Guide for Directors and Officers and Board Governance, Minutes, and Corporate Formalities: A Practical Checklist — read both with the Delaware caveat above in mind. For tax treatment of the PC/MSO stack, see Business Taxation: A Comprehensive Guide to Entity Choice and Federal Income Tax. If your organization is a nonprofit hospital or clinic, add Forming and Operating a Nonprofit: A Comprehensive Guide to Tax-Exempt Status, because private inurement and excess-benefit rules overlay everything in Pillars 4 and 5.

Healthcare consolidation is itself a transactional practice: physician-group roll-ups, hospital affiliations, and PE platform deals all run on the ordinary M&A machinery, with fraud-and-abuse diligence bolted on. When Rivermark's sponsor acquires the next practice, the deal follows the arc in Mergers and Acquisitions: A Comprehensive Guide from Letter of Intent to Closing, and the diligence follows Conducting Merger and Acquisition Due Diligence: A Practical Checklist — to which you must add a healthcare overlay: every physician financial relationship (Pillar 5), every billing history and open overpayment (Pillar 7), every exclusion screen (Pillar 2), and every unremediated HIPAA risk-analysis finding (Pillar 3). Successor liability for fraud-and-abuse exposure is real, and an unremediated Stark defect you buy is a Stark defect you own. The MSA, the employment agreements, and the payer contracts underneath the deal are ordinary commercial paper — draft and review them against The Commercial Contracts Toolkit: Drafting, Reviewing, and Enforcing Business Agreements.

Pillar 2 — Licensing, credentialing, and scope of practice

Three distinct systems get confused constantly.

Licensure is the state's permission to practice at all. It is granted by state boards under state medical, nursing, and allied-health practice acts. Practicing without it — or beyond your scope — is typically a crime and, in the federal payer context, renders the services non-covered. That matters: services furnished by an unlicensed or improperly supervised provider can be treated as claims for services not rendered as billed, which is a False Claims Act theory (Pillar 6).

Credentialing and privileging is the hospital's or health system's process for verifying training and granting the right to practice within that institution. Payer enrollment is separate again — Medicare enrollment is governed by 42 C.F.R. Part 424, subpart P, and CMS may revoke billing privileges under 42 C.F.R. § 424.535 for, among other things, felony convictions, non-compliance with enrollment requirements, and abuse of billing privileges.

Exclusion screening is the piece most often skipped and most often penalized. Under 42 U.S.C. § 1320a-7, the OIG must exclude individuals convicted of program-related crimes and may exclude for a long list of other reasons. No federal healthcare program payment may be made for items or services furnished, ordered, or prescribed by an excluded person — including administrative staff. Employing an excluded person and billing federal programs exposes the employer to civil monetary penalties under 42 U.S.C. § 1320a-7a. Screen the OIG List of Excluded Individuals/Entities and the federal exclusion database at hire and monthly thereafter, and document it.

Rivermark: A per-diem radiology technologist turns out to have been excluded three years earlier following a state Medicaid conviction in another state. Rivermark's monthly LEIE screening catches it in week two. Two weeks of associated technical-component claims are voided and refunded within the 60-day window (Pillar 8). Had the screen been annual, the exposure would have been eleven months of imaging claims, trebled.

Pillar 3 — HIPAA: privacy, security, and breach notification

The architecture. HIPAA (42 U.S.C. § 1320d et seq.), as amended by the HITECH Act, is implemented in three rules found at 45 C.F.R. Parts 160 and 164:

  • The Privacy Rule (45 C.F.R. §§ 164.500–164.534) governs uses and disclosures of protected health information. The organizing principle is that PHI may be used or disclosed for treatment, payment, and healthcare operations without authorization; nearly everything else requires a valid authorization or fits a specific permitted-disclosure category. The minimum necessary standard (§ 164.502(b)) applies to almost everything except treatment.
  • The Security Rule (45 C.F.R. §§ 164.302–164.318) governs electronic PHI and requires administrative, physical, and technical safeguards, anchored by a genuine, documented, current risk analysis (§ 164.308(a)(1)(ii)(A)). In OCR enforcement, a missing or stale risk analysis is the single most commonly cited failure.
  • The Breach Notification Rule (45 C.F.R. §§ 164.400–164.414) requires notice to affected individuals without unreasonable delay and no later than 60 days after discovery; notice to HHS contemporaneously with individual notice (i.e., within the same 60-day window) for breaches affecting 500 or more individuals, and via an annual log for smaller breaches; and notice to prominent media outlets serving a state or jurisdiction where more than 500 residents are affected. An impermissible use or disclosure is presumed to be a breach unless a documented four-factor risk assessment shows a low probability of compromise.

Who is covered. Covered entities (providers who bill electronically, health plans, clearinghouses) and their business associates — vendors who create, receive, maintain, or transmit PHI on their behalf. Business associates are directly liable under HIPAA, and a written business associate agreement is mandatory. This is where most modern exposure sits: the cloud EHR, the transcription vendor, the billing company, the AI scribe. Work through HIPAA in the Cloud: Business Associates, BAAs, and Protecting ePHI before you sign anything, and run HIPAA Compliance: A Practical Checklist annually.

Three things people get wrong.

  1. HIPAA is a floor, not a ceiling. More stringent state law survives preemption (45 C.F.R. § 160.203). State medical-records statutes, genetic privacy laws, and consumer health data statutes stack on top. Substance use disorder records carry their own regime at 42 C.F.R. Part 2.
  2. There is no private right of action under HIPAA. Federal courts have uniformly so held — see, e.g., Acara v. Banks, 470 F.3d 569 (5th Cir. 2006). But plaintiffs route around it: HIPAA supplies the standard of care for state negligence, negligence per se, and privacy tort claims, and state UDAP statutes do the rest.
  3. Most "health apps" are not covered by HIPAA at all. A direct-to-consumer wellness app that never contracts with a covered entity is regulated instead by the FTC Act and the FTC's Health Breach Notification Rule (16 C.F.R. Part 318), plus state consumer health privacy statutes.

For the surrounding privacy architecture — data mapping, vendor diligence, policy drafting, and the state patchwork — use The Privacy and Data Protection Toolkit: Building and Operating a Compliance Program and Standing Up a Privacy Compliance Program: A Practical Checklist. When something leaks, HIPAA's 60-day clock is only one of the clocks running: see Data Breach Notification Law: A Comprehensive Guide and Responding to a Data Breach: A Notification and Incident Response Checklist. If your clinic uses fingerprint or face-based staff timekeeping or patient check-in, add Biometric Privacy Law and the AI Systems That Read Faces and Voices — biometric statutes in states like Illinois carry statutory damages and a private right of action that HIPAA does not.

Pillar 4 — Fraud and abuse: the Anti-Kickback Statute

The rule. The Anti-Kickback Statute (AKS), 42 U.S.C. § 1320a-7b(b), makes it a felony to knowingly and willfully solicit, receive, offer, or pay any remuneration — directly or indirectly, overtly or covertly, in cash or in kind — to induce or reward referrals of items or services reimbursable by a federal healthcare program.

Four features make it dangerous:

  • "Any remuneration" means any. Free rent below market. A medical director agreement with no real duties. A speaker fee. Free staff. Discounted EHR licenses. A steak dinner, in volume.
  • It is intent-based, but the intent bar is low. The ACA amendment at 42 U.S.C. § 1320a-7b(h) confirms that a defendant need not have actual knowledge of the statute or specific intent to violate it.
  • The "one purpose" rule. If one purpose of the payment is to induce referrals, the statute is violated, even if the arrangement also serves legitimate purposes. See United States v. Greber, 760 F.2d 68 (3d Cir. 1985), the origin of the rule and the reason "but we really did need a medical director" is not a defense.
  • It feeds the False Claims Act. Under 42 U.S.C. § 1320a-7b(g), a claim that includes items or services resulting from an AKS violation is a false claim for FCA purposes. That is the bridge from a criminal statute to treble civil damages and qui tam relators.

The safe harbors (42 C.F.R. § 1001.952) are voluntary. Falling outside one is not itself a violation — but arrangements outside a safe harbor are evaluated on the facts, and the government's facts are your emails. The workhorses: bona fide employment, personal services and management contracts, space and equipment rental, investment interests, and the newer value-based arrangement safe harbors.

Rivermark's near-miss. Rivermark wants to pay a local orthopedic group a "co-management fee" for helping design its imaging workflow. The fee is proposed at 3% of imaging revenue. Stop. Compensation tied to the volume or value of referrals from a referral source is the paradigm case. Counsel restructures: a fixed annual fee set in advance, supported by a fair-market-value opinion, tied to a written scope of work with time logs, and untethered from imaging volume. That structure fits the personal services safe harbor and, more importantly, is true.

Pillar 5 — Fraud and abuse: the Stark Law

The rule. The Stark Law (physician self-referral law), 42 U.S.C. § 1395nn, implemented at 42 C.F.R. §§ 411.350–411.389, prohibits a physician who has a financial relationship with an entity — ownership, investment, or compensation — from referring Medicare patients to that entity for designated health services (DHS), and prohibits the entity from billing for those referred services, unless an exception applies.

The two things to internalize:

  1. Stark is strict liability. Intent is irrelevant to the referral-and-billing prohibition. A technically defective compensation arrangement — an expired lease, an unsigned amendment, a rent that drifted below fair market value — breaks the exception, and every DHS claim flowing from that physician's referrals becomes non-payable. The remedy is an overpayment, and an overpayment knowingly retained past 60 days is a reverse false claim (Pillar 6).
  2. Exceptions are the whole game. The common ones: bona fide employment (§ 1395nn(e)(2)), personal service arrangements (§ 1395nn(e)(3)), rental of office space and equipment (§ 1395nn(e)(1)), and the in-office ancillary services exception (§ 1395nn(b)(2)) — the exception that permits group practices to keep imaging and lab in-house, subject to demanding supervision, location, and billing conditions. CMS's 2020 value-based rulemaking added exceptions at 42 C.F.R. § 411.357(aa) for value-based arrangements with meaningful downside risk.

Nearly every exception requires the same four elements: in writing, signed, set in advance, at fair market value, commercially reasonable, and not determined in a manner that takes into account the volume or value of referrals. Memorize that sentence. It is the entire compliance program for physician compensation.

Rivermark: Rivermark's MRI is a DHS. It relies on the in-office ancillary services exception, which means the imaging must be furnished in the same building where the group provides its full range of physician services, supervised as required, and billed by the group. When Rivermark opens a standalone imaging suite two blocks away and keeps billing under the group's number, the exception evaporates — not because anyone did anything venal, but because the building changed. That is Stark in one sentence: geography and paperwork are substantive law.

Pillar 6 — The False Claims Act and qui tam exposure

The rule. The False Claims Act, 31 U.S.C. §§ 3729–3733, imposes liability on anyone who knowingly presents a false or fraudulent claim for payment to the government, knowingly makes a false record material to such a claim, or knowingly conceals or improperly avoids an obligation to pay money to the government (the reverse false claim). Damages are treble, plus a substantial per-claim civil penalty. In healthcare, where a claim is a line item, per-claim penalties can dwarf actual damages.

Scienter under § 3729(b)(1) means actual knowledge, deliberate ignorance, or reckless disregard — no specific intent to defraud required. In United States ex rel. Schutte v. SuperValu Inc., 598 U.S. 739 (2023), the Supreme Court held that scienter turns on the defendant's subjective belief at the time, not on whether some objectively reasonable interpretation of an ambiguous rule might have permitted the conduct. The "my lawyer could have argued it was ambiguous" defense died there.

Implied certification and materiality. Universal Health Services, Inc. v. United States ex rel. Escobar, 579 U.S. 176 (2016) confirmed that a claim can be false by implication — a provider who submits a claim implicitly represents compliance with material conditions — but tightened materiality to a "demanding" standard. Materiality is not satisfied merely because the government could have denied payment; courts look at whether the government consistently pays or refuses to pay claims with knowledge of the violation. Escobar is a defense lawyer's best friend and a compliance officer's warning: anti-kickback and Stark violations are essentially always material, because Congress said so in § 1320a-7b(g) and because CMS conditions payment on them.

Qui tam. Under 31 U.S.C. § 3730(b), a private relator — usually a former employee, biller, or competitor — may sue in the government's name under seal. If the government intervenes, the relator takes 15–25% of the recovery; if it declines and the relator proceeds alone, 25–30%. Guardrails include the first-to-file bar (§ 3730(b)(5)) and the public disclosure bar (§ 3730(e)(4)). The government retains authority to dismiss over the relator's objection, confirmed in United States ex rel. Polansky v. Executive Health Resources, Inc., 599 U.S. 419 (2023). And § 3730(h) protects relators from retaliation — which means the coding manager who complains about upcoding is legally radioactive.

The practical lesson: your FCA risk is a function of how your own employees feel. A functioning internal reporting channel is not a nicety. It is the mechanism by which a $40,000 problem stays a $40,000 problem instead of becoming a sealed complaint. For the criminal-side overlay — health care fraud under 18 U.S.C. § 1347, wire fraud, obstruction, and the mechanics of corporate criminal liability — see White-Collar Crime and Corporate Criminal Liability: A Comprehensive Guide.

Pillar 7 — Billing, coding, and reimbursement compliance

Fraud enforcement is downstream of coding. Five recurring theories account for most of it:

  • Upcoding — billing a higher-level evaluation and management service than the documentation supports. Statistical outliers on E/M distribution are how contractors find you.
  • Unbundling — billing component codes separately when a comprehensive code exists, typically by overriding National Correct Coding Initiative edits with modifiers. The reflexive modifier -59 is a red flag.
  • Medical necessity — the service was performed and coded correctly but was not reasonable and necessary for diagnosis or treatment. This is where imaging, labs, and DME live.
  • Services not rendered as billed — including "incident to" and supervision failures, where a mid-level's service is billed under the physician's number without the required supervision.
  • Improper cost-sharing waivers — routinely waiving copays and deductibles is remuneration to beneficiaries and can trigger the beneficiary-inducement civil monetary penalty at 42 U.S.C. § 1320a-7a(a)(5), plus AKS exposure. Financial-hardship waivers are permissible when individualized, documented, and not advertised.

The 60-day rule. Under 42 U.S.C. § 1320a-7k(d) (ACA § 6402(a)), an identified overpayment must be reported and returned within 60 days of identification, and retention beyond that is an "obligation" whose knowing avoidance is a reverse false claim. "Identification" means when the provider has, or should have through reasonable diligence, determined the overpayment and quantified it. The practical consequence: the moment you find one bad claim, a clock starts and you must scope the problem. Do not investigate leisurely.

Audits and appeals. Contractor audits (UPIC, RAC, MAC, and payer SIU reviews) usually begin with a probe sample and extrapolate. The Medicare appeals ladder — redetermination, reconsideration by a QIC, ALJ hearing at OMHA, the Medicare Appeals Council, and judicial review (42 C.F.R. Part 405, subpart I) — is long, and preserving your record at level one matters more than most providers appreciate. Challenge the extrapolation methodology, not only the individual claims; a flawed sample can vacate a seven-figure demand.

Pillar 8 — Building a compliance program and self-disclosure

The seven elements. The OIG's Compliance Program Guidance — refreshed in the General Compliance Program Guidance (November 2023) — and the Federal Sentencing Guidelines at U.S.S.G. § 8B2.1 converge on the same architecture:

  1. Written standards, policies, and a code of conduct
  2. A compliance officer and compliance committee with real authority and a line to the board
  3. Effective training and education
  4. Effective lines of communication, including an anonymous hotline
  5. Auditing and monitoring — including claims audits with statistical sampling
  6. Enforcement of standards through well-publicized disciplinary guidelines
  7. Prompt response to detected offenses and corrective action

The board dimension matters. Directors of healthcare organizations have oversight duties over compliance, and the failure of a board to establish and monitor a reporting system — or to respond to red flags it does surface — is the classic Caremark oversight theory, a frequent add-on derivative claim after a government settlement. Be precise about what that doctrine is: Caremark is Delaware corporate law, developed in the Delaware Court of Chancery and refined by the Delaware Supreme Court, and it applies to your organization because (and only to the extent that) your entity is incorporated in Delaware or your state's courts have chosen to follow Delaware's lead. Many have; some have not, and some apply a materially different oversight standard. Delaware is the reference point in this toolkit, not a national rule. See Corporate Governance and Fiduciary Duties: A Comprehensive Guide for Directors and Officers for the doctrine and its state variation.

Self-disclosure. Three doors, and picking the right one is a legal judgment:

  • OIG Self-Disclosure Protocol — for conduct implicating the Anti-Kickback Statute or other fraud with potential CMP liability. Typical benefit: a reduced multiplier and, usually, no Corporate Integrity Agreement.
  • CMS Voluntary Self-Referral Disclosure Protocol (SRDP) — for Stark-only violations (established by ACA § 6409). Stark-only means Stark-only; if kickback intent is in the facts, you are in the wrong protocol.
  • Refund to the contractor — for straightforward, non-fraud overpayments under the 60-day rule.

Disclosing does not immunize you. It converts an unbounded, government-driven, relator-vulnerable exposure into a bounded, negotiated one — and it forecloses the qui tam relator who is drafting a complaint on the same facts. That trade is usually worth making, but only after a privileged internal investigation has scoped the conduct.

Use HIPAA Compliance: A Practical Checklist for the privacy leg of the program and The Small Business Legal Toolkit for the contracting and entity hygiene underneath it.

And check your insurance before you need it. Work through The Business Insurance and Coverage Toolkit and, when a carrier says no, Insurance Coverage Law: A Comprehensive Guide for Policyholders. Three points. Most professional liability policies exclude intentional fraud and the disgorgement of amounts wrongfully obtained — which is precisely what an FCA settlement is, so the policy you assume covers your worst day frequently does not. Regulatory defense coverage and cyber/privacy coverage are separately purchased and separately sub-limited, and a HIPAA-breach response can exhaust a modest cyber sub-limit on notification costs alone. And tender early: late notice is among the most common reasons coverage is lost. Critically, insurance is regulated at the state level — policy interpretation, the standard for an insurer's duty to defend, whether a "notice-prejudice" rule excuses late notice, and the availability of bad-faith remedies are all matters of state law that differ materially, and this toolkit states no national rule on any of them. Read your policy under the law of the state whose law governs it.

Pillar 9 — Telehealth, digital health, and AI in clinical care

Licensure follows the patient. The near-universal rule is that a clinician must be licensed in the state where the patient is located at the time of the encounter. The Interstate Medical Licensure Compact expedites licensure across member states; it does not create a national license. Multi-state telehealth is therefore a licensing-inventory problem before it is a technology problem.

Controlled substances. The Ryan Haight Act, 21 U.S.C. § 829(e), generally requires an in-person medical evaluation before prescribing controlled substances by means of the internet, subject to statutory and regulatory exceptions and to telemedicine flexibilities that have been extended and modified repeatedly. Because that regime keeps moving, verify the current DEA rule before you build a workflow on it.

Fraud and abuse, again. Telehealth has generated a disproportionate share of enforcement, almost all of it AKS: staffing companies paying per-consult fees to clinicians who never meaningfully evaluated patients, in exchange for orders for DME, genetic tests, or braces. If your telehealth compensation model pays per order rather than per encounter, you have built a kickback engine.

Software, devices, and AI. Clinical software may be a regulated device. The 21st Century Cures Act amended the FDCA (21 U.S.C. § 360j(o)) to carve out certain clinical decision support software from device regulation — but only where the software displays its basis and the clinician can independently review the recommendation rather than relying primarily on it. An AI tool that drives the decision is more likely regulated than one that informs it. Separately, ONC's information-blocking rules (42 U.S.C. § 300jj-52; 45 C.F.R. Part 171) require transparency about decision-support interventions in certified health IT, and ACA § 1557 (42 U.S.C. § 18116) reaches discrimination effectuated through patient care decision support tools — meaning a clinical algorithm that produces disparate outcomes by race or disability is a civil rights problem, not only a clinical one.

Before deploying any clinical or administrative AI, run the governance workflow in AI Governance and Compliance: A Comprehensive Guide and Deploying an AI System: An AI Governance and Risk Checklist. Two healthcare-specific overlays: (1) an AI vendor that processes PHI is a business associate and needs a BAA — including ambient scribes that record the visit; and (2) using PHI to train a vendor's model is generally not treatment, payment, or operations, and requires either a valid authorization or properly executed de-identification under 45 C.F.R. § 164.514.

Rivermark: Rivermark's AI triage assistant is licensed from a startup whose standard terms grant a perpetual license to use "de-identified data" for model improvement. Counsel demands the de-identification method (Safe Harbor or Expert Determination), a BAA, and a prohibition on re-identification — and discovers the vendor was retaining full transcripts. That is a business associate breach waiting to be someone else's headline.

Pillar 10 — Employment and workforce issues in healthcare

Healthcare employment is ordinary employment law plus four aggravating factors.

  • Wage and hour. Nursing and residential care are chronic FLSA exposure zones: automatic meal-break deductions for staff who work through breaks, unpaid pre- and post-shift work, and miscalculated regular rates that omit shift differentials. Hospitals and residential care establishments may elect the "8 and 80" overtime system under 29 U.S.C. § 207(j) — a genuine option, and a genuine trap when applied without the required agreement. Start with Wage and Hour Law Under the FLSA: A Comprehensive Guide.
  • Classification. Per-diem clinicians, locum tenens physicians, and "1099 nurse practitioners" are classification claims in waiting — and a misclassified supervising physician can also blow up an "incident to" billing theory. See Worker Classification: A Comprehensive Guide to Employee and Independent Contractor Status and Classifying Workers: Employee or Independent Contractor — A Practical Checklist.
  • Physician non-competes. State law, and increasingly state law specific to physicians. Texas, for example, imposes special requirements on physician non-competes, including a buyout and continued patient access to records (Tex. Bus. & Com. Code § 15.50(b)); several states restrict or bar them outright. Track the moving landscape in The Future of Non-Competes: FTC Rulemaking and the State-Law Patchwork.
  • Whistleblowers. FCA § 3730(h) retaliation, state healthcare-specific whistleblower statutes, and internal reports of patient safety concerns all converge. Never discipline a clinician who has recently complained about billing or safety without a documented, contemporaneous, independent basis — the sequence alone is a prima facie case.

The rest of the lifecycle — offers, handbooks, accommodations, discipline, separation — lives in The Employment Law Toolkit: From Hiring to Separation, Employment Discrimination Law: A Comprehensive Guide, and Drafting an Employee Handbook That Holds Up: A Practical Checklist. Add a confidentiality architecture that survives clinician departures: Building an Enforceable NDA Clause by Clause: A Practical Checklist.

Pillar 11 — Investigations, subpoenas, and enforcement

Know who is knocking. The instrument tells you the forum:

Instrument Source What it signals
Civil Investigative Demand 31 U.S.C. § 3733 (DOJ Civil) A False Claims Act investigation — very often a sealed qui tam
OIG subpoena Inspector General Act; testimonial subpoena authority drawn from 42 U.S.C. § 405(d) Administrative fraud / civil monetary penalty investigation
Grand jury subpoena Fed. R. Crim. P. 17 Criminal
OCR data request HIPAA enforcement Privacy/security — often triggered by your own breach report
Contractor / payer audit letter 42 C.F.R. Part 405 Overpayment; may be the front end of something larger
Search warrant Fourth Amendment The government did not want to give you notice

The first 48 hours. Issue a litigation hold immediately and suspend auto-deletion — obstruction charges are how good cases become terrible ones, and in healthcare the auto-deletion is usually running inside the EHR, the secure-messaging app, and the billing system simultaneously. Follow Issuing a Litigation Hold and Preserving ESI: A Practical Checklist rather than improvising. Route all contact through counsel. Do not instruct employees not to speak with investigators; you may lawfully tell them they have a choice, that they may have counsel present, and that the company will not retaliate either way. Anything more is witness-tampering territory. Preserve privilege in the internal investigation by conducting it at counsel's direction and giving proper Upjohn warnings — Upjohn Co. v. United States, 449 U.S. 383 (1981), establishes that the corporate attorney-client privilege belongs to the company, not the employee, which means the company alone may waive it and the employee must be told so before the interview begins.

Then scope the conduct, quantify it, and decide the Pillar 8 question: disclose, refund, or defend. Work the sequence in Responding to a Government Subpoena or Investigation: A Practical Checklist.

Rivermark, finally: A CID arrives. It requests imaging claims for a three-year period and "all documents concerning compensation of referring physicians." Rivermark's counsel reads that as two investigations wearing one coat — a Stark theory on the relocated MRI suite and an AKS theory on the orthopedic co-management fee. Because Rivermark had already restructured the fee, documented fair market value, self-identified the in-office ancillary services failure, and refunded within 60 days, the case resolves as a negotiated overpayment with a modest multiplier rather than an intervened FCA action. The difference between those two outcomes is not luck. It is Pillar 8.

Worked example: Rivermark Health Partners, end to end

The vignettes above are fragments. Here is the whole arc, with numbers, because the point of this toolkit is that the pillars are not independent — a failure in one becomes a claim under another, and the arithmetic is what makes healthcare counsel's advice worth taking.

The facts. Rivermark Health Partners is a four-site primary care and imaging group. It is structured as a physician-owned professional corporation (Dr. Alvarez, sole shareholder) with a Delaware-incorporated MSO, Rivermark Management LLC, owned by a private equity sponsor. The MSO provides billing, HR, real estate, IT, and marketing under a management services agreement paying a flat annual fee plus a cost-plus component. Rivermark bills Medicare and three commercial payers, operates an in-office MRI, and has launched a telehealth line with an AI triage assistant. Annual Medicare imaging revenue: roughly $2.4 million.

What goes wrong. Three things, none of them venal.

  1. The MRI moves. Rivermark outgrows its main building and opens a standalone imaging suite two blocks away — a better patient experience, more parking, a genuinely good operational decision. Nobody tells counsel. The group keeps billing the technical component under its group number, still relying on the in-office ancillary services exception to Stark (42 U.S.C. § 1395nn(b)(2)), which requires the DHS to be furnished in the same building where the group provides its full range of physician services. The building changed. The exception evaporated on the day the suite opened. This is not fraud. It is strict liability (Pillar 5).
  2. The co-management fee. Rivermark proposes paying a local orthopedic group — a referral source — 3% of imaging revenue as a "co-management fee" for helping design imaging workflows. That is compensation varying with the volume and value of referrals: the paradigm Anti-Kickback case, and under the one purpose rule of United States v. Greber, 760 F.2d 68 (3d Cir. 1985), the fact that the orthopedists really did do useful design work is no defense (Pillar 4).
  3. The AI vendor. The triage assistant's vendor is retaining full patient transcripts under a contract term permitting use of "de-identified data" for model improvement — without a business associate agreement and without any documented de-identification under 45 C.F.R. § 164.514 (Pillars 3 and 9).

The arithmetic if nothing is caught. Eighteen months of MRI technical-component claims tainted by the Stark defect is roughly $3.6 million in non-payable DHS claims. Because those claims were non-payable, retaining the money past the 60-day deadline in 42 U.S.C. § 1320a-7k(d) converts each one into an obligation knowingly avoided — a reverse false claim under 31 U.S.C. § 3729(a)(1)(G). Trebled, that is $10.8 million, before per-claim civil penalties, which in a line-item business like imaging can independently exceed the damages. Add the AKS-tainted orthopedic referrals, which under 42 U.S.C. § 1320a-7b(g) are false claims per se, and the materiality fight that Escobar would otherwise offer is over before it starts — Congress and CMS have already said these violations are material. A former billing manager who raised the MRI question in an email, was ignored, and was later let go is now both a § 3730(h) retaliation plaintiff and a qui tam relator entitled to 15–30% of the recovery.

What actually happens, because the program works. Rivermark's compliance officer runs a quarterly financial-relationships inventory (Gate 4). The relocated MRI surfaces in the first review after the move — flagged not by a lawyer but by a real-estate line item that no longer matched the address on the group's Stark exception memo. Counsel is called on day 9.

  • Scope and quantify. A privileged internal review, run at counsel's direction with Upjohn warnings, quantifies $310,000 in DHS claims billed after the relocation date, over roughly seven weeks.
  • Stop the bleeding. Billing for the standalone suite is suspended pending restructuring. Counsel re-papers the arrangement to fit a different Stark exception and re-enrolls the site correctly.
  • Choose the door. The conduct is Stark-only — no kickback intent anywhere in the facts — so the CMS Voluntary Self-Referral Disclosure Protocol (ACA § 6409) is the right protocol, not the OIG SDP. Picking the wrong door here would have been a serious error: the OIG SDP is for conduct implicating the Anti-Kickback Statute, and walking Stark-only conduct into it invites a fraud framing that the facts do not support.
  • Return the money. The overpayment is reported and refunded inside the 60-day window, so no reverse-false-claim obligation ever matures.
  • Fix the fee. The 3% co-management proposal is restructured before signing into a fixed annual fee, set in advance, supported by a written fair-market-value opinion, tied to a defined scope of work with time logs, and completely untethered from imaging volume. It now fits the personal services and management contracts safe harbor at 42 C.F.R. § 1001.952(d) — and, more to the point, it is true.
  • Fix the vendor. The AI vendor signs a BAA, discloses its de-identification method (Expert Determination), and accepts a contractual prohibition on re-identification and on training against identifiable PHI.

The outcome. A CID arrives fourteen months later — the ex-billing-manager did file. It requests imaging claims for three years and "all documents concerning compensation of referring physicians": two theories wearing one coat. But by then Rivermark has a documented self-disclosure, a completed refund, a fair-market-value opinion predating the co-management agreement, and a contemporaneous compliance-committee record showing the problem was found internally and fixed. The matter resolves as a negotiated overpayment with a modest multiplier — mid-six figures, all in, including fees — rather than an intervened False Claims Act action in the eight figures with a Corporate Integrity Agreement attached for five years.

The lesson. The difference between those two outcomes is not luck, and it is not lawyering after the fact. It is a quarterly inventory, a compliance officer with a phone number, and a 60-day clock that somebody owns. That is Pillar 8, and it is the only pillar that pays for itself.

The landscape as a working checklist

Gate 1 — Structure (before you see a patient)

  • [ ] Confirm whether your state enforces the corporate practice of medicine doctrine, and how.
  • [ ] Form the professional entity; paper the MSA at fair market value with real clinical control in the PC.
  • [ ] Confirm state fee-splitting rules before agreeing to any percentage-of-collections economics.
  • [ ] Adopt bylaws, appoint the board, calendar minutes.

Gate 2 — Licensure and enrollment

  • [ ] License every clinician in every state where patients are located.
  • [ ] Complete Medicare/Medicaid enrollment and payer credentialing before billing.
  • [ ] Screen every workforce member and vendor against the LEIE at hire and monthly.

Gate 3 — Privacy and security

  • [ ] Current, documented Security Rule risk analysis — and a risk management plan that closes the findings.
  • [ ] Executed BAAs with every vendor that touches PHI, including AI tools.
  • [ ] Notice of Privacy Practices, minimum-necessary policies, access and amendment procedures.
  • [ ] Breach response plan mapping HIPAA's 60-day clock against state notification deadlines.

Gate 4 — Financial relationships

  • [ ] Inventory every financial relationship with every referral source. Every one.
  • [ ] For each: in writing, signed, term of at least one year, set in advance, fair market value, commercially reasonable, not varying with volume or value of referrals.
  • [ ] Identify the Stark exception and the AKS safe harbor relied on, by citation, in a compliance memo.
  • [ ] Re-paper before expiration. Diary every renewal date.

Gate 5 — Billing integrity

  • [ ] Annual (at minimum) claims audit with statistical sampling by an independent reviewer.
  • [ ] E/M distribution and modifier-usage monitoring against benchmarks.
  • [ ] Written policy on cost-sharing waivers — individualized hardship only, never advertised.
  • [ ] A 60-day overpayment procedure with a named owner and a documented clock.

Gate 6 — Program and response

  • [ ] Seven-element compliance program, with an empowered compliance officer reporting to the board.
  • [ ] Anonymous hotline; documented non-retaliation; investigation and corrective-action log.
  • [ ] Litigation-hold template and an investigation-response protocol ready before the CID arrives.
  • [ ] Confirm regulatory-defense and cyber coverage limits, and tender promptly.

Primary Authority

Statutes

Regulations

Cases

State law (representative examples only — these are NOT national rules; confirm your jurisdiction)

The following subjects are governed by state law and vary materially from state to state. The citations below are illustrations of how particular states have legislated, offered to show the shape of the problem — they are not statements of a general American rule, and none of them governs unless it is your state's law.

  • Corporate practice of medicine and professional entities: Cal. Bus. & Prof. Code § 2400; Cal. Corp. Code § 13400 et seq. (Moscone-Knox Professional Corporation Act); N.Y. Bus. Corp. Law art. 15; N.Y. Ltd. Liab. Co. Law art. 12. Enforcement intensity ranges from aggressive to effectively dormant. Fee-splitting prohibitions are separate state rules and must be checked separately.
  • Physician non-competes: Tex. Bus. & Com. Code § 15.50(b) (buyout and records-access requirements). Several states restrict or prohibit physician non-competes outright; others enforce them on ordinary reasonableness principles.
  • Corporate governance and director oversight duties: Delaware is this toolkit's reference point — the Caremark oversight doctrine, the duty of loyalty framing of oversight failure, and the demand-futility standards that gate derivative suits are Delaware law. Delaware is widely followed but not binding elsewhere. Apply the law of your state of incorporation.
  • Insurance regulation, policy interpretation, duty to defend, notice-prejudice, and bad faith: state law, no national rule.
  • Unfair and deceptive acts and practices (UDAP): state statutes with divergent elements, remedies, and regulated-conduct exemptions. There is no private federal UDAP claim.
  • Licensure, scope of practice, supervision, medical records, and telehealth modality rules: state law, and the single most common source of error in multi-state healthcare operations.

Secondary Sources

  • HHS-OIG, General Compliance Program Guidance (Nov. 2023) and industry-specific Compliance Program Guidance documents
  • HHS-OIG Self-Disclosure Protocol; CMS Voluntary Self-Referral Disclosure Protocol (ACA § 6409)
  • U.S. Sentencing Guidelines Manual § 8B2.1 (effective compliance and ethics program)
  • OIG Advisory Opinions and Special Fraud Alerts (persuasive, party-specific, and the best available window into enforcement thinking)

Related UpLaw Resources

Related Guides & Articles

Related Checklists

Related Toolkits

This toolkit is general legal information from UpLaw (uplaw.us), not legal advice, and does not create an attorney-client relationship. Healthcare law varies by state and changes frequently — particularly the corporate practice of medicine doctrine, licensure and telehealth rules, and controlled-substance prescribing requirements. Verify current federal and state requirements and consult qualified healthcare counsel before acting.