The Whistleblower and Retaliation Toolkit

Litigation > Whistleblower and Qui Tam | Published 16 September 2025 - Updated 9 July 2026 | UpLaw - uplaw.us

Whistleblower law is not one body of law. It is five or six overlapping regimes with different awards, different protections, different filing mechanics, and — critically — different consequences for reporting internally first. A lawyer who files in the wrong one, or files in the right one after doing something that forfeits protection in another, has made a mistake that cannot be undone.

Keywords: FCA, qui tam, relator share, Escobar, SuperValu, first-to-file, public disclosure, § 3730(h), SEC program, Digital Realty, SOX § 806, Murray v. UBS, Rule 21F-17, internal reporting

---

How to read this toolkit

This is a resource map, not a treatise. It walks twelve pillars of whistleblower and retaliation practice. Under each you get the governing doctrine in plain terms, the anchor authority, the trap that catches people, and the UpLaw documents that develop it.

Four ground rules first.

One: choose the regime before doing anything. The FCA, the SEC and CFTC programs, the IRS program, and the anti-retaliation statutes have different triggers and different sequencing consequences. Reporting internally is required for some protections and fatal to others.

Two: the evidence question comes before the merits question. What the client may lawfully take is the first conversation, not the fifth. A relator who removes protected health information or privileged material to prove fraud can destroy the case and their own position.

Three: on the FCA side, procedure eliminates more cases than doctrine. The first-to-file bar, the public disclosure bar, and Rule 9(b) particularity end cases that would have won on the merits.

Four: on the employer side, the internal report is the case. After SuperValu made scienter subjective, the internal complaint that was received and not acted on is the single most damaging document a defendant can produce.

Start here for the doctrinal treatment: The False Claims Act: A Comprehensive Guide to Qui Tam Litigation and Government Fraud Enforcement. For the narrative introduction: Blowing the Whistle. For the filing sequence: Filing a Qui Tam Complaint Under Seal: A Relator's Checklist.

Our running matters. Dr. Naomi Cross (fictional), a cardiologist at Arden Valley Health Partners (fictional). Brightline Systems, Inc. (fictional), a federal IT contractor that certified security controls it had not implemented. Rowan Achebe (fictional), a controller at a public company who reported revenue recognition irregularities to the audit committee and was terminated.

---

Pillar 1 — Choosing the regime

Doctrine. Not doctrine — triage. The award programs: the False Claims Act (15–30%), the SEC program (10–30% of sanctions over $1 million), the CFTC program, the IRS program (15–30% above thresholds), the AML program, and the motor vehicle safety program. The protection statutes: FCA § 3730(h), Sarbanes-Oxley § 806, Dodd-Frank § 922, and dozens of OSHA-administered statutes.

Anchor. The client's facts, mapped against every regime before anything is filed anywhere.

Trap. Digital Realty Trust, Inc. v. Somers, 583 U.S. 149 (2018): Dodd-Frank's anti-retaliation protection requires reporting to the SEC. An employee who reports only internally is protected by SOX but not by Dodd-Frank — with materially different limitations periods and remedies. Advise on both, and file with the SEC if Dodd-Frank protection is wanted.

Trap, second order. The FCA does not permit anonymous filing; the SEC program does, through counsel. Where the facts support both, that difference alone may drive the choice.

Go deeper: The False Claims Act: A Comprehensive Guide · SEC Enforcement: A Comprehensive Guide to Investigations, Wells Notices, and Remedies

---

Pillar 2 — FCA liability and the sealed procedure

Doctrine. Liability for knowingly presenting a false claim, making a false record material to one, conspiring, or improperly avoiding an obligation to pay. Qui tam actions are filed under seal, served on the government with a written disclosure statement, and held for at least sixty days while the government investigates.

Anchors. 31 U.S.C. §§ 3729, 3730, 3733 (civil investigative demands); State Farm Fire & Casualty Co. v. United States ex rel. Rigsby, 580 U.S. 26 (2016) (seal violations).

Trap. Treating the written disclosure statement as a formality. It, not the complaint, drives the intervention decision — and intervened cases produce the overwhelming majority of recoveries. Write it as an investigative memorandum for a reader who has never seen the industry, with a witness list, an evidence index, a loss calculation, and a candid treatment of the defenses.

Trap, second order. The evidence question. Courts have divided on whether public policy protects a relator's removal of employer documents. Protected health information, classified material, and privileged documents create independent exposure regardless of the fraud. Advise before anything is taken, and prefer building the case from lawfully held documents plus the government's own claims data.

Go deeper: Filing a Qui Tam Complaint Under Seal: A Relator's Checklist · Responding to a Government Subpoena or Investigation: A Practical Checklist

---

Pillar 3 — Materiality

Doctrine. Implied false certification is a valid theory where the claim makes specific representations and the failure to disclose noncompliance renders them misleading half-truths — but materiality is "rigorous" and "demanding," and neither a condition-of-payment label nor the government's option to withhold payment establishes it.

Anchor. Universal Health Services, Inc. v. United States ex rel. Escobar, 579 U.S. 176, 190, 194–95 (2016).

Trap. The continued-payment factor. Where the government pays claims in full with actual knowledge of the violation, that is "very strong evidence" the requirement is not material. Defendants build this record from agency audits, contemporaneous guidance, and known industry practice. Relators must address it affirmatively in the disclosure statement — the government will find it anyway.

Trap, second order. Circuits divide on whether Escobar's two conditions are required or merely sufficient. Check before choosing venue.

Go deeper: The False Claims Act: A Comprehensive Guide · Blowing the Whistle

---

Pillar 4 — Scienter after SuperValu

Doctrine. The FCA's scienter element is subjective. A defendant who believed its claims were false is liable even if an objectively reasonable person could have read the requirement otherwise.

Anchors. 31 U.S.C. § 3729(b)(1) (actual knowledge, deliberate ignorance, reckless disregard; no specific intent required); United States ex rel. Schutte v. SuperValu Inc., 598 U.S. 739, 749 (2023).

Trap. The defense is now evidentiary, not legal. Internal emails saying "this is aggressive" or "let's not put this in writing," compliance memos that were shelved, and consultant reports that were buried are the case. Conversely, contemporaneous written legal analysis of an ambiguous requirement is now a genuine defense asset.

Trap, second order. Asserting advice of counsel waives privilege over the subject matter. After SuperValu the temptation is stronger and the decision is harder. Make it deliberately and early.

Go deeper: Legal Ethics and Professional Responsibility: A Comprehensive Guide to the Model Rules · Conducting a Workplace Investigation: A Practical Checklist

---

Pillar 5 — The bars

Doctrine. The first-to-file bar excludes a later relator alleging the same essential facts. The public disclosure bar excludes claims based on substantially the same allegations already disclosed in federal proceedings, federal reports, or the news media, unless the relator is an original source or the government opposes dismissal. Limitations run six years, or three years after the responsible official knew, capped at ten.

Anchors. § 3730(b)(5); § 3730(e)(3)–(4); § 3731(b); Kellogg Brown & Root Services, Inc. v. United States ex rel. Carter, 575 U.S. 650 (2015); Rockwell International Corp. v. United States, 549 U.S. 457 (2007); Graham County Soil & Water Conservation District v. United States ex rel. Wilson, 559 U.S. 280 (2010); Cochise Consultancy, Inc. v. United States ex rel. Hunt, 587 U.S. 262 (2019).

Trap. First to file is a race against an invisible competitor. Earlier complaints are sealed. A second relator with better evidence loses to a weaker first filing on the same facts. That is an argument for filing promptly rather than perfecting.

Trap, second order. Since 2010 the public disclosure bar is non-jurisdictional, raised on a Rule 12(b)(6) motion — which means the complaint should plead original source status affirmatively on its face.

Trap, third order. Cochise makes a ten-year reach-back realistic where the government learned late, even in a declined case. Do not assume six years.

Go deeper: Filing a Qui Tam Complaint Under Seal: A Relator's Checklist

---

Pillar 6 — The arithmetic

Doctrine. Actual damages, trebled, plus a civil penalty for each claim, adjusted annually for inflation. A prevailing relator recovers 15–25% (intervened) or 25–30% (declined), plus fees and costs from the defendant.

Anchors. § 3729(a)(1); § 3730(d); 28 C.F.R. § 85.5 (current penalty range); United States v. Bornstein, 423 U.S. 303 (1976) (treble first, then credit payments).

Trap. The per-claim penalty stack. High-volume, low-value billing produces penalty exposure far exceeding damages — a $16 million loss across 8,000 claims can generate $160 million of exposure. That ratio, not the liability standard, is why these cases settle.

Trap, second order. The Excessive Fines Clause is the defense's principal answer. Several circuits apply United States v. Bajakajian, 524 U.S. 321 (1998), to FCA penalties and a few have reduced awards. The doctrine is unsettled — preserve it.

Trap, third order. In health care settlements, the corporate integrity agreement the OIG requires often costs more than the payment. Negotiate it with the same care.

Go deeper: The Litigation Damages Toolkit: Valuing and Proving Money Awards · Drafting and Closing a Settlement Agreement: A Practical Checklist

---

Pillar 7 — FCA retaliation

Doctrine. § 3730(h) protects lawful acts in furtherance of an FCA action and other efforts to stop a violation — which reaches internal complaints, and does not require that the employee be right, only reasonable. Relief is reinstatement with seniority, two times back pay with interest, and special damages including fees.

Anchor. 31 U.S.C. § 3730(h); three-year limitations period at § 3730(h)(3).

Trap. Sequencing. The retaliation claim is filed publicly. Filing it while a qui tam is sealed may reveal the qui tam. Coordinate with the government before filing, and calendar the three-year clock so holding the claim does not lose it.

Trap, second order. "Contractor or agent" coverage means the protection extends beyond employees — but not to every relationship. Check the status.

Go deeper: Damages in Employment Litigation: Back Pay, Statutory Caps, and Punitive Awards · Employment Discrimination Law: A Comprehensive Guide

---

Pillar 8 — The securities, commodities, and tax award programs

Doctrine. Monetary awards for original information leading to successful enforcement, with different thresholds and mechanics.

Program	Authority	Award	Anonymity
SEC	Dodd-Frank § 21F, 15 U.S.C. § 78u-6	10%–30% of sanctions over $1M	Yes, through counsel
CFTC	7 U.S.C. § 26	10%–30%	Yes, through counsel
IRS	26 U.S.C. § 7623(b)	15%–30% above thresholds	No
AML/sanctions	31 U.S.C. § 5323	Up to 30%	Yes
Motor vehicle safety	49 U.S.C. § 30172	Up to 30%	Yes

Trap. The 120-day lookback. Under the SEC rules, a whistleblower who reports internally first and then submits to the SEC within 120 days is treated as having submitted on the earlier internal date — which preserves both the award position and the credit for internal reporting. Missing that window forfeits the benefit.

Trap, second order. Award enhancement and reduction factors matter and are litigable: significance of the information, assistance provided, law enforcement interest, and participation in internal compliance systems increase the award; culpability, unreasonable delay, and interference with internal compliance reduce it.

Go deeper: SEC Enforcement: A Comprehensive Guide to Investigations, Wells Notices, and Remedies · Handling an IRS Audit and Tax Controversy: A Comprehensive Guide · The Securities Litigation and Enforcement Toolkit

---

Pillar 9 — Sarbanes-Oxley and Dodd-Frank anti-retaliation

Doctrine. SOX § 806 protects employees of public companies (and certain contractors and subsidiaries) who provide information about conduct they reasonably believe violates specified securities laws or federal fraud statutes — including internal reporting to a supervisor or the audit committee. Dodd-Frank § 922 provides a separate, longer-limitations retaliation claim, but only for those who reported to the SEC.

Anchors. 18 U.S.C. § 1514A; Digital Realty Trust, Inc. v. Somers, 583 U.S. 149 (2018); Murray v. UBS Securities, LLC, 601 U.S. 23 (2024); Lawson v. FMR LLC, 571 U.S. 429 (2014) (contractor employees covered).

Trap. SOX has a 180-day administrative filing deadline with OSHA — one of the shortest in employment law — followed by a right to remove to federal district court after 180 days without a final decision. Miss the administrative filing and the claim is gone.

Trap, second order. Murray v. UBS held that a SOX complainant need not prove retaliatory intent; the burden-shifting framework requires only that protected activity was a contributing factor, after which the employer must show by clear and convincing evidence that it would have taken the same action anyway. That is a plaintiff-friendly standard and it changed the settlement value of these cases.

Trap, third order. Rowan Achebe's audit committee report is SOX-protected but not Dodd-Frank-protected unless he also reported to the SEC. Advise on both at the first meeting.

Go deeper: Public Company Disclosure and Reporting: A Practical Checklist · Securities Fraud Litigation: A Comprehensive Guide to Rule 10b-5 Private Actions

---

Pillar 10 — State and sector-specific protections

Doctrine. A dense layer beneath the federal regimes: more than thirty state false claims acts, most with qui tam provisions and many limited to Medicaid; state whistleblower statutes protecting public and private employees; the common law tort of wrongful discharge in violation of public policy; and dozens of OSHA-administered federal statutes covering transportation, environment, food safety, consumer products, and nuclear safety.

Anchors. State FCAs (incentivized by Social Security Act § 1909's increased state Medicaid recovery share); state whistleblower acts; the public policy tort as recognized in the relevant state.

Trap. State FCAs have their own filing, sealing, and service requirements that differ from the federal ones. A relator filing parallel state claims must comply with each state's procedure separately, and failures are not curable.

Trap, second order. The public policy tort frequently offers remedies the statutes do not — punitive damages and jury trial — and is frequently overlooked because the statutory claim seems more direct. Check whether the state treats the statute as exclusive.

Go deeper: Employment Discrimination Law: A Comprehensive Guide · The Employment Law Toolkit: From Hiring to Separation

---

Pillar 11 — Employer side: the internal reporting program

Doctrine. Not a statute — a design problem. A program that actually receives and resolves complaints is the strongest available defense, because it prevents violations, defeats the deliberate ignorance theory, and reduces the chance the employee goes external first.

Anchor. The U.S. Sentencing Guidelines' effective compliance program criteria, U.S.S.G. § 8B2.1, and the Department of Justice's Evaluation of Corporate Compliance Programs, which both ask whether the reporting mechanism is known, trusted, and used.

The design elements that matter. Multiple reporting channels including one outside the direct chain of command. A stated and enforced non-retaliation policy. Acknowledgment of every report within a defined period. Triage criteria and an owner for each report. Documented resolution — including a documented decision not to act, with reasons. Metrics reported to the board. And a periodic look-back asking whether reports that were closed should have been.

Trap. The single most damaging document in a post-SuperValu FCA case is an internal report that was received and not acted on. A program that logs complaints without resolving them is worse than no program, because it proves knowledge.

Trap, second order. Retaliation risk management around a known complainant. Any adverse action affecting someone who reported requires documented, contemporaneous, independent justification reviewed before it is taken. Most retaliation verdicts turn on timing.

Go deeper: The Corporate Compliance Toolkit · Conducting a Workplace Investigation: A Practical Checklist · Building a Legally Sound Employee Handbook

---

Pillar 12 — Agreements that cannot silence

Doctrine. A growing body of law invalidates and penalizes contractual restrictions on reporting to the government.

Anchors. SEC Rule 21F-17 (prohibiting any action impeding communication with the Commission, including through confidentiality agreements) with a long line of enforcement actions over separation and NDA language; the Dodd-Frank and Sarbanes-Oxley anti-waiver provisions; the National Labor Relations Board's decision in McLaren Macomb, 372 N.L.R.B. No. 58 (2023), on overbroad confidentiality and non-disparagement terms in severance agreements; the Speak Out Act, 42 U.S.C. §§ 19401–19404, barring pre-dispute nondisclosure and non-disparagement clauses covering sexual assault and harassment disputes; and criminal obstruction exposure for agreements to conceal a federal offense.

Trap. Standard separation agreement language. A general confidentiality clause with no carve-out for government reporting is an independent violation in the securities context and is voidable in others. Every separation agreement, NDA, and employee certification should carry an express government-reporting carve-out naming the SEC, the DOJ, the EEOC, OSHA, and any relevant regulator, and stating that the employee need not seek permission or notify the employer.

Trap, second order. Paying for silence about a federal crime is not merely unenforceable. Depending on the facts it can be misprision or obstruction.

Go deeper: Paying for Silence: Why "I Won't Report You" Clauses Can Void Your Settlement and Expose You to Criminal Charges · Reductions in Force and Severance: A Comprehensive Guide to WARN, OWBPA, and Separation Agreements · Non-Disclosure Agreements for Technology Deals: Drafting for Enforceability

---

The authority shelf

False Claims Act

• 31 U.S.C. §§ 3729–3733
• Universal Health Services, Inc. v. United States ex rel. Escobar, 579 U.S. 176 (2016)
• United States ex rel. Schutte v. SuperValu Inc., 598 U.S. 739 (2023)
• United States ex rel. Polansky v. Executive Health Resources, Inc., 599 U.S. 419 (2023)
• Cochise Consultancy, Inc. v. United States ex rel. Hunt, 587 U.S. 262 (2019)
• State Farm Fire & Cas. Co. v. United States ex rel. Rigsby, 580 U.S. 26 (2016)
• Kellogg Brown & Root Servs., Inc. v. United States ex rel. Carter, 575 U.S. 650 (2015)
• Rockwell Int'l Corp. v. United States, 549 U.S. 457 (2007)
• Graham County Soil & Water Conservation Dist. v. United States ex rel. Wilson, 559 U.S. 280 (2010)
• Allison Engine Co. v. United States ex rel. Sanders, 553 U.S. 662 (2008) (superseded by FERA 2009)
• Vermont Agency of Natural Res. v. United States ex rel. Stevens, 529 U.S. 765 (2000)
• Cook County v. United States ex rel. Chandler, 538 U.S. 119 (2003)
• United States v. Bornstein, 423 U.S. 303 (1976)
• United States ex rel. Marcus v. Hess, 317 U.S. 537 (1943)

Health care overlay

• 42 U.S.C. § 1320a-7b (Anti-Kickback Statute), including § 1320a-7b(g)
• 42 U.S.C. § 1395nn (Stark)
• 42 U.S.C. § 1320a-7k(d) (sixty-day overpayment rule)
• 42 C.F.R. § 1001.952 (safe harbors); 42 C.F.R. §§ 411.350–411.389 (Stark regulations)

Award programs

• 15 U.S.C. § 78u-6 (SEC); 17 C.F.R. §§ 240.21F-1 to 21F-18
• 7 U.S.C. § 26 (CFTC)
• 26 U.S.C. § 7623 (IRS)
• 31 U.S.C. § 5323 (AML)

Anti-retaliation

• 31 U.S.C. § 3730(h) (FCA)
• 18 U.S.C. § 1514A (SOX § 806)
• 15 U.S.C. § 78u-6(h) (Dodd-Frank § 922)
• Digital Realty Trust, Inc. v. Somers, 583 U.S. 149 (2018)
• Murray v. UBS Securities, LLC, 601 U.S. 23 (2024)
• Lawson v. FMR LLC, 571 U.S. 429 (2014)

Silencing restrictions

• SEC Rule 21F-17, 17 C.F.R. § 240.21F-17
• McLaren Macomb, 372 N.L.R.B. No. 58 (2023)
• Speak Out Act, 42 U.S.C. §§ 19401–19404

Secondary sources

• John T. Boese, Civil False Claims and Qui Tam Actions (the practitioner standard)
• Claire M. Sylvia, The False Claims Act: Fraud Against the Government
• U.S. Department of Justice, annual False Claims Act statistics
• U.S.S.G. § 8B2.1 (effective compliance and ethics program)
• DOJ Criminal Division, Evaluation of Corporate Compliance Programs

---

Appendix A — The regime-selection matrix

Run every client's facts against all of these before filing anything.

Question	If yes
Was money obtained from, or owed to, the federal government?	FCA qui tam
Was the conduct a securities law violation by a public company or regulated entity?	SEC program; SOX § 806; Dodd-Frank § 922 (requires SEC report)
Was it commodities or derivatives?	CFTC program
Was it tax underpayment above the statutory thresholds?	IRS § 7623(b)
Was it money laundering or sanctions evasion?	AML program
Did state funds flow (Medicaid, state contracts)?	State false claims acts, filed in parallel
Did the client report only internally?	SOX yes; Dodd-Frank no; FCA § 3730(h) yes
Does the client need anonymity?	SEC/CFTC yes; FCA no
Is the client's principal need job protection rather than an award?	SOX (180-day OSHA deadline), § 3730(h), state statutes, public policy tort
Has anything already been publicly disclosed?	Original source analysis under § 3730(e)(4)(B)

---

Appendix B — First two weeks

Relator side.

Days 1–2. Engagement letter. The instruction not to take anything further, in writing. The instruction not to discuss the matter, in writing. Conflicts check.

Days 3–5. Evidence inventory: what the client has, and how each item was obtained. Screen for PHI, privileged material, and classified information.

Days 6–8. Run the bars: first-to-file docket search, public disclosure search, government action bar, limitations computation under both prongs of § 3731(b).

Days 9–11. Build the theory. Name the liability provision and the falsity theory. Confront materiality and subjective scienter directly. Screen for an AKS or Stark overlay that converts a hard clinical case into a documentary one.

Days 12–14. Quantify. Choose venue with attention to the circuit's Rule 9(b) standard. Map every alternative regime from Appendix A and sequence the retaliation claim so a public filing does not blow the seal.

Employer side.

Days 1–2. On a civil investigative demand or a credible internal report: litigation hold, immediately and broadly. Assume a sealed complaint exists.

Days 3–5. Scope the privileged internal investigation. Identify the decisionmakers and the documents that will show what they believed — because after SuperValu that is the case.

Days 6–10. Build the materiality record: agency audits, contemporaneous guidance, industry practice, and any instance of the government paying with knowledge.

Days 11–14. Decide on self-disclosure and on any advice-of-counsel assertion. In health care, start the sixty-day overpayment clock analysis independently of the investigation's convenience. Protect the complainant from any adverse action, and document that protection.

---

Related Documents

Guides

• The False Claims Act: A Comprehensive Guide to Qui Tam Litigation and Government Fraud Enforcement
• Healthcare Compliance: A Comprehensive Guide to HIPAA, Stark, and the Anti-Kickback Statute
• SEC Enforcement: A Comprehensive Guide to Investigations, Wells Notices, and Remedies
• White Collar Crime and Corporate Criminal Liability: A Comprehensive Guide
• Employment Discrimination Law: A Comprehensive Guide

Articles

• Blowing the Whistle: How a Civil War Statute Became the Government's Sharpest Fraud Weapon
• Paying for Silence: Why "I Won't Report You" Clauses Can Void Your Settlement
• Grease, Gifts, and Third Parties: Where FCPA Cases Actually Come From
• Damages in Employment Litigation: Back Pay, Statutory Caps, and Punitive Awards

Checklists

• Filing a Qui Tam Complaint Under Seal: A Relator's Checklist
• Responding to a Government Subpoena or Investigation: A Practical Checklist
• Conducting a Workplace Investigation: A Practical Checklist
• Building an Anti-Corruption Compliance Program: A Practical Checklist

Toolkits

• The Corporate Compliance Toolkit
• The Healthcare Law Toolkit
• The Government Contracts Toolkit
• The Securities Litigation and Enforcement Toolkit