Client Alert: DOJ Makes Healthcare Fraud Its Top Corporate Enforcement Priority: What Providers Should Know
Assistant Attorney General Colin McDonald's October 1 memo tells National Fraud Enforcement Division prosecutors to put healthcare fraud first when deciding which companies to investigate and charge. Here is what that means for practices, agencies and pharmacies.
KEY TAKEAWAYS
- DOJ's new Directive 26-12 lists healthcare fraud, controlled substance distribution and FDCA violations as the first priority for corporate fraud investigations.
- Since April, the Fraud Division has added healthcare prosecutors and a shared data center, and it is opening investigations proactively from data analytics.
- "Corporate" includes many providers. Practices, agencies, pharmacies, labs and DME suppliers that bill through an LLC or professional corporation can be investigated as entities.
- Prosecutors must give "great weight" to factors such as management knowledge, concealment from auditors and conduct lasting three years or more.
- When a whistleblower reports both internally and to DOJ, the company has a 120-day window to self-report and still qualify for credit under DOJ's self-disclosure policy.
- A conviction can trigger mandatory exclusion from Medicare and Medicaid for at least five years.
On October 1, 2026, Assistant Attorney General Colin M. McDonald issued Directive 26-12, "Corporate Enforcement in the Fight Against Fraud," to prosecutors in the Justice Department's National Fraud Enforcement Division (the Fraud Division). The memo sets the Fraud Division's priorities for opening corporate investigations, and healthcare comes first:
"In opening and conducting a corporate investigation, Fraud Division prosecutors should prioritize: Fraud schemes involving the health care industry, including health care fraud, distribution of controlled substances, and violations of the Federal Food, Drug, and Cosmetic Act."
This follows two developments we covered in July: the 2026 National Health Care Fraud Takedown and federal pressure on state Medicaid Fraud Control Units. This directive addresses when the business itself, and not only the people who run it, becomes the defendant, six months into a rapid build-out of DOJ's healthcare fraud enforcement.
Why healthcare providers should act now
Since April, the Fraud Division has added healthcare prosecutors, expanded its health care fraud strike forces (which have charged more than 6,200 defendants to date) and launched a shared data platform with the agencies that police provider billing.
| Date | Development |
|---|---|
| April 7 | Fraud Division created, with the Health Care Fraud Unit among its components. |
| April 30 | New West Coast Health Care Fraud Strike Force, with at least ten Fraud Division prosecutors. |
| May 22 | 15 more Medicaid fraud prosecutors authorized; Midwest Strike Force expanded. |
| June 23 | National Health Care Fraud Takedown charges 455 defendants. |
| August 24 | National Fraud Detection Center launches, joining HHS-OIG, the FBI and other agencies on shared technology. |
| October 1 | Directive 26-12 puts healthcare first for corporate investigations. |
Investigations can start from data, not complaints. The directive states that, by "leveraging" data analytics "through the National Fraud Detection Center and partner components," the Division is "proactively generating leads and opening new individual and corporate fraud investigations at a rapid pace." In data-driven matters, a provider may not learn of an inquiry until a subpoena issues.
Entities of any size can be subjects. The directive's corporate focus is not limited to large companies, and company size is not among the factors prosecutors must weigh.
Records requests reach beyond targets. A provider that is not a target can still be subpoenaed for records about a referral source, billing vendor or former employee, and its response can shape its role in the case.
Data-driven enforcement can compress the time between an internal issue and a government inquiry. Reviewing billing practices, internal reporting channels and records-response procedures is easier done now than under a subpoena deadline.
What does DOJ's new corporate enforcement memo say?
In an August 13 memo, McDonald set the Fraud Division's overall priorities, including Medicare and Medicaid fraud, telemedicine fraud, home health and hospice schemes, kickbacks, controlled substance diversion and improper opioid prescribing.
Directive 26-12 carries those priorities into corporate cases. It puts the Fraud Division's Corporate Enforcement Section on corporate investigations from intake through resolution, and it gave prosecutors seven days to report every ongoing corporate investigation to the Section's Chief.
Does "corporate" enforcement apply to physician practices and agencies?
Often, yes. Many physician practices, behavioral health agencies, home health and hospice agencies, pharmacies, laboratories and DME suppliers bill through a professional corporation, LLC or similar entity. In a healthcare fraud investigation into one of those businesses, the entity is a potential subject alongside its owners and managers.
The three named categories also reach smaller operations. Controlled substance distribution covers pharmacies and prescribing practices. The Federal Food, Drug, and Cosmetic Act can reach businesses in the drug and device supply chain, including compounding pharmacies and med spas, when their handling of drugs or devices raises adulteration or misbranding issues.
The responsible corporate officer doctrine
FDCA cases carry a particular risk for owners. Under United States v. Park, 421 U.S. 658 (1975), an officer with authority to prevent or correct certain FDCA violations can face misdemeanor liability without proof of intent.
Which factors matter most in a healthcare fraud investigation?
The directive lists ten factors on which prosecutors "must place great weight" when deciding whether to charge a company or negotiate a plea or other agreement. The memo calls the list "non-exhaustive" and lets prosecutors weigh any other relevant factor. Six line up closely with healthcare cases.
| Factor in the memo | How it can show up in a healthcare case |
|---|---|
| Knowledge of or involvement in the scheme by corporate management | In an owner-operated practice or agency, the owner usually is management. A physician-owner's knowledge may be treated as the company's knowledge. |
| Efforts to conceal fraud from government agencies or auditors | Audit response. In the Virginia Takedown case we covered in July, the criminal information alleges records were altered after investigators requested them. |
| Conduct lasting three years or more | Coding habits built into a workflow can repeat for years before anyone reviews them. |
| Conduct affecting multiple taxpayer-funded programs | Billing Medicare, Medicaid and TRICARE from the same templates. |
| Conduct affecting three or more federal districts | Virginia has two districts and Maryland one. A group with offices in Northern Virginia, Roanoke and Baltimore already spans three. |
| Actions that threaten the safety or security of Americans | Controlled substance diversion and drug safety matters. |
How do whistleblowers and self-disclosure fit in?
The directive instructs Fraud Division leadership to design programs that "appropriately incentivize whistleblowers," including people who took part in the conduct. In healthcare, that usually means billing staff, coders, clinicians and former managers, who can already file qui tam suits under the False Claims Act.
The directive also requires prosecutors to follow DOJ's Department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy, issued in March 2026. That policy provides a path to a declination for a company that voluntarily self-discloses, fully cooperates and timely remediates, absent aggravating circumstances. Whether a company meets those criteria is often a judgment call, and DOJ retains discretion.
The policy includes a deadline providers should know. If a whistleblower reports both internally and to DOJ, the company can still qualify by self-reporting as soon as reasonably practicable and no later than 120 days after receiving the internal report, even if the whistleblower reached DOJ first. Because a company may not know whether an internal reporter has also gone to DOJ, internal complaints deserve prompt attention.
DOJ is not the only self-disclosure path. The HHS-OIG Health Care Fraud Self-Disclosure Protocol is a separate route for providers subject to civil monetary penalties. Which path fits, if any, depends on the facts and is a decision to make with counsel.
What does this mean for Virginia and Maryland providers?
By its terms, the directive does not extend to cases a U.S. Attorney's Office assigns to a District Fraud Counsel without Fraud Division supervision. Healthcare matters in Virginia and Maryland, though, can involve the Health Care Fraud Unit working alongside the local U.S. Attorney's Offices.
An audit request, a data flag or an internal complaint can become the record a prosecutor uses to decide whether to charge the business itself. A conviction for a program-related offense, felony healthcare fraud or a felony controlled substance offense triggers mandatory exclusion from Medicare, Medicaid and other federal health care programs for at least five years under 42 U.S.C. ยง 1320a-7. For an entity that depends on those programs, exclusion can threaten its viability.
Talk with Whiteford's healthcare fraud defense team
The Fraud Division is moving quickly, and the first response to a government contact often shapes what follows. Whiteford's healthcare defense group represents providers in Virginia, Maryland and federal matters in government investigations, Medicaid and Medicare audits, and the licensure and enrollment proceedings that often follow. The group also advises on fraud and abuse compliance, including self-disclosure decisions. If your organization has received a records request, or a compliance concern has surfaced internally, contact Eric Atkinson to arrange a confidential consultation.
The information contained here is not intended to provide legal advice or opinion and should not be acted upon without consulting an attorney. Counsel should not be selected based on advertising materials, and we recommend that you conduct further investigation when seeking legal representation.