Health Care Law lawyers

Health care law is what happens when a fifth of the economy runs on government money, private insurance, and professional licensure at the same time. The field is not one doctrine but a lattice of them: fraud and abuse statutes that police how medicine is paid for, privacy rules that police its information, and regulatory regimes that police who may practice and where. This guide walks the lattice in order, and the payment statutes come first because they carry the criminal exposure.

The False Claims Act, 31 U.S.C. sections 3729 to 3733, is the government's principal fraud weapon, a Civil War statute retooled in 1986 with treble damages, per-claim penalties, and a qui tam provision that lets private whistleblowers, called relators, sue on the government's behalf and keep a share of the recovery. In health care the false claim is usually a bill: services not rendered, upcoded severity, medically unnecessary procedures, or claims tainted by unlawful referral arrangements. The qui tam engine matters as much as the substance, because employees, billing staff, and competitors initiate most of the government's biggest cases.

The Anti-Kickback Statute, 42 U.S.C. section 1320a-7b(b), criminalizes knowingly offering, paying, soliciting, or receiving remuneration to induce referrals of federal health care program business. Remuneration means anything of value, and the statute's reach is so wide that regulators publish safe harbors, for space rentals, employment, personal services contracts, and more, that describe arrangements the government will not prosecute. An arrangement outside a safe harbor is not automatically illegal, but it lives on intent, and a kickback-tainted claim is also a false claim by statute, which chains the two laws together.

The Stark Law, 42 U.S.C. section 1395nn, is the strict liability sibling. It prohibits a physician from referring Medicare patients for designated health services to an entity with which the physician or a family member has a financial relationship, unless an exception fits exactly. Intent is irrelevant; a compensation arrangement that drifts from fair market value or loses a signature can convert years of routine referrals into repayment liability. Health care law practice spends enormous hours on Stark exceptions precisely because good faith is no defense.

HIPAA supplies the information layer. The Health Insurance Portability and Accountability Act of 1996 and its Privacy, Security, and Breach Notification Rules, 45 C.F.R. parts 160 and 164, govern how covered entities and their business associates use, disclose, and protect health information. HIPAA sets a federal floor, not a ceiling: it permits disclosures for treatment, payment, and operations, requires safeguards proportionate to risk, and since the HITECH Act carries tiered civil penalties and breach notification duties enforced by the Office for Civil Rights. The statute also does quiet definitional work across the field, because business associate agreements are now standard plumbing in every health care transaction. HIPAA also created a federal criminal offense of wrongful disclosure, prosecuted rarely but severely, and HIPAA-trained staff are now a hiring requirement across the industry.

EMTALA, 42 U.S.C. section 1395dd, is the field's emergency conscience. Any hospital with an emergency department that participates in Medicare must screen anyone who presents and stabilize emergency conditions before transfer or discharge, regardless of ability to pay. Enforcement runs through CMS and the OIG, with termination from Medicare as the ultimate sanction, and EMTALA litigation has lately become a constitutional flashpoint where federal stabilization duties meet state abortion restrictions.

Around these five pillars stand the program statutes themselves: the Medicare and Medicaid Acts with their conditions of participation, the exclusion authorities that bar violators from federal programs, and the Civil Monetary Penalties Law that prices lesser offenses. Exclusion deserves respect it rarely gets in headlines, because for a provider it is commercial death: no federal program will pay for an excluded person's services, directly or indirectly. Practitioners shorthand the whole cluster as fraud and abuse, and it fills more pages of a health care law treatise than any other topic.

Licensure and professional regulation form the third strand. Medicine is licensed state by state, disciplined by state boards, and organized under state corporate practice doctrines, all covered in the next section, while facilities answer to CMS conditions, state licensure, and private accreditors like the Joint Commission at once.

Transactions in this field are compliance events. A physician group acquisition, a hospital joint venture, a management services arrangement, each must be built inside Stark exceptions and kickback safe harbors, priced at defensible fair market value, and documented for the day an auditor or relator reads the file. Health care law is unusual in that its deal work and its defense work are the same body of knowledge applied at different temperatures, and every diligence checklist in the field starts with the same three questions: who refers, who pays, and where the data goes.

What the federal lattice leaves open, the states fill, and they fill it differently: who may own a medical practice, what a nurse practitioner may do alone, which privacy rules exceed HIPAA's floor, and how telehealth crosses borders. That state layer is the next section.

The states hold the oldest power in health care law: they decide who may practice medicine. Licensure, scope of practice, facility regulation, and much of privacy law are state affairs, and the variation is wide enough that identical clinical operations can be lawful in one state and criminal in its neighbor.

The corporate practice of medicine doctrine is the sharpest structural divide. Roughly half the states, California, Texas, and New York among the strict ones, prohibit corporations or non-physicians from employing physicians to practice medicine or from owning medical practices, on the old theory that lay control corrupts clinical judgment. The workaround is the friendly PC and management services organization structure: a physician-owned professional corporation holds the clinical practice while an MSO provides everything else under a management agreement. Health care law practice in strict states is substantially the craft of building and defending these structures, and private equity investment in medicine has made the doctrine newly contentious, with several states legislating fresh restrictions on management control.

Scope of practice is a fifty-state negotiation. Nurse practitioners hold full independent practice authority in roughly half the states and work under physician supervision or collaboration agreements in the rest; physician assistants, pharmacists, and psychologists each have their own patchwork. The battles are legislative and continuous, and for any multi-state provider the compliance question is never what clinicians can do, but what they can do here.

Telehealth turned that patchwork into a national problem. The default rule is that practice occurs where the patient sits, so a physician video-visiting patients in three states needs three licenses. The Interstate Medical Licensure Compact expedites multi-state licensure for physicians, and the nursing compact goes further with a true multistate license, but coverage is incomplete and modality rules, audio-only visits, prescribing without in-person exams, remote controlled substance prescribing under the Ryan Haight Act's shifting waivers, differ state to state. Pandemic-era flexibilities expired unevenly, leaving a compliance map that changes quarterly, and multi-state platforms retain healthcare law counsel largely to keep that map current.

Privacy is a layered federalism story. HIPAA preempts contrary state law but expressly yields to state rules that are more protective, and many are. California's Confidentiality of Medical Information Act, New York's new health information law, and the wave of consumer health privacy statutes led by Washington's My Health My Data Act reach entities and data that HIPAA never touched, including period-tracking apps and wellness platforms. Specialty rules run stricter still: substance use disorder treatment records under 42 C.F.R. Part 2, HIV status, mental health notes, and minors' reproductive care each carry consent regimes above the HIPAA baseline in many states, and reproductive health data has become its own fast-moving field since Dobbs. The practical result is that HIPAA compliance alone no longer answers the privacy question in most large states.

State fraud statutes mirror the federal ones with local accents. Most states run their own false claims acts, many with qui tam provisions, incentivized by federal Medicaid recoveries; all-payer kickback statutes in states like California and New York reach purely commercial insurance, closing the gap the federal Anti-Kickback Statute leaves for non-federal business; and state insurance fraud units prosecute billing schemes the federal government would never notice. A compliance program built only to federal specifications is incomplete in most large states.

Certificate of need laws still govern facility expansion in roughly thirty-five states, requiring state permission to build hospitals, add beds, or buy major equipment, with fierce local litigation over each certificate. Facility licensure adds its own inspections and staffing ratios, California's nurse staffing law the famous example, and states differ on whether ambulatory surgery centers, urgent care, and behavioral health facilities need distinct licenses.

Medicaid is the biggest state variable of all. Each state runs its own program within federal boundaries: eligibility rules, managed care structures, provider rates, and expansion status under the Affordable Care Act all vary, and a provider's Medicaid compliance obligations are set by state plan and state regulation as much as by federal law. Audits by state Medicaid fraud control units are a routine of practice life in every state, and state Medicaid manuals function as binding law in practice, so health care law compliance teams track their revisions the way tax departments track rulings.

Professional discipline rounds out the layer. State medical boards investigate complaints, discipline licenses, and report to the National Practitioner Data Bank, and their standards differ on everything from opioid prescribing to telemedicine relationships. A license action in one state now propagates: other states, hospitals, and payers all see it, and reciprocal discipline follows.

For any provider operating across state lines, the practical lesson is that health care law compliance is a matrix, federal rules on one axis, each state's rules on the other, and the matrix must be maintained, because both axes move. How enforcement and disputes actually proceed through that matrix, from subpoena to settlement, is the next section.

Health care enforcement rarely announces itself with a raid. It arrives as paper: a civil investigative demand, an OIG subpoena, a payer audit letter, or the quiet docketing of a sealed qui tam complaint the provider will not learn about for years. Reading the paper correctly is the first professional skill the process demands.

The qui tam timeline explains much of the field's strangeness. A relator files under seal, the government investigates in secret, sixty days by statute and often years by extension, and then elects to intervene, decline, or seek dismissal. Intervened cases settle at high rates; declined cases proceed at the relator's expense with worse odds. For the provider, the first visible sign is often a CID or subpoena that reveals the government's interest but not the relator's identity, and defense counsel's early work is inferring the theory from the document requests.

Government investigations run on parallel tracks that must be managed together. The same billing pattern can interest the DOJ civilly under the False Claims Act, the DOJ criminally under the health care fraud statute, 18 U.S.C. section 1347, the OIG for exclusion and civil monetary penalties, CMS for payment suspension, and the state Medicaid fraud control unit, simultaneously. Payment suspension deserves particular fear: CMS may suspend Medicare payments on credible allegations of fraud, and for a practice living on program revenue, the suspension is the sentence, imposed before any adjudication.

Self-disclosure is the process's institutional off-ramp. Providers who find their own violations may repay overpayments within the sixty-day rule, use the OIG's Self-Disclosure Protocol for kickback-tainted conduct, or the CMS Voluntary Self-Referral Disclosure Protocol for Stark violations, trading admission for reduced multipliers and, usually, release from exclusion. The sixty-day overpayment clock, running from when an overpayment is identified, converts an innocent billing error retained too long into False Claims Act exposure, which is why internal audits in this field come with lawyers attached.

Compliance infrastructure is both prevention and mitigation. The OIG's compliance program guidance defines the expected elements, written standards, a compliance officer, training, auditing, reporting channels, and enforcement, and the government prices cooperation and program quality into resolutions. Corporate integrity agreements, the multi-year monitoring regimes attached to major settlements, are the recidivism apparatus, complete with independent review organizations and annual certifications signed by executives personally. Health care law rewards the provider who can show the program worked in practice, not just on paper.

HIPAA enforcement has its own lane. Breaches affecting five hundred or more individuals must be reported to the Office for Civil Rights and are posted publicly; OCR investigates complaints and breaches, resolves most matters with technical assistance, and settles the serious ones with resolution agreements and corrective action plans. There is no private right of action under HIPAA, a fact that surprises patients weekly, but state attorneys general may sue, and plaintiffs increasingly repackage breaches as state law negligence and consumer protection class actions, so a large breach now means OCR, state AGs, and civil litigation at once. Business associates answer to OCR directly since HITECH, and HIPAA penalties now reach the vendors as readily as the providers.

Payment disputes have their own long staircase. Medicare claim denials and extrapolated audit demands climb five levels: redetermination, reconsideration, administrative law judge hearing, Appeals Council, then federal court. Statistical extrapolation, where a sampled error rate is projected across years of claims, turns small audits into seven-figure demands, and challenging the sampling methodology is half the appellate craft. The ALJ backlog that once stretched years has eased but remains a planning fact.

Licensure defense is a parallel process with different rules. Board investigations begin with a complaint and a records request, proceed through informal conferences toward consent orders or administrative hearings, and end in discipline that reports to the National Practitioner Data Bank, triggering hospital peer review, payer network exits, and reciprocal actions elsewhere. The collateral cascade is the real penalty, and counsel who treats a board letter as routine correspondence has already lost ground.

Transactions run the same machinery in reverse. Deal diligence in this field is regulatory archaeology, sampling claims, testing arrangements against Stark exceptions and safe harbors, reviewing HIPAA security risk analyses, and pricing successor liability, because the buyer of a practice buys its billing history. Regulatory approval, change of ownership filings, and in a growing number of states, advance notice of health care transactions add months to closings.

Timelines are honest bad news. Government fraud investigations commonly run two to five years before resolution; qui tam cases under seal can sleep longer. Board matters resolve in months to two years. Appeals of extrapolated audits span years. The process is the punishment in much of health care law, and managing a client's operations, cash flow, and nerves through it is as much the job as any brief.

Everything above has a number attached somewhere, recoveries, settlements, breach counts, exclusion totals, and the verified ones tell you where enforcement actually concentrates. Those numbers are the next section.

Scale first, because it explains the enforcement appetite. National health expenditures reached 4.9 trillion dollars in 2023, growing 7.5 percent over the prior year and accounting for 17.6 percent of gross domestic product, about 14,570 dollars per person (cms.gov, National Health Expenditure data). Nothing else Americans buy consumes a share of the economy that large, and no other industry mixes public money and private billing at that volume. Hospitals, physician services, and prescription drugs take the largest shares of the total, and federal programs fund roughly a third of it, which is the enforcement jurisdiction hook for everything below.

Enforcement recoveries are published annually and worth reading in the original. The Department of Justice reported more than 2.68 billion dollars in False Claims Act settlements and judgments for fiscal year 2023, across a record 543 settlements and judgments, and over 1.8 billion of it, roughly two-thirds, came from health care matters: managed care plans, hospitals, pharmacies, laboratories, and physicians (justice.gov). Qui tam cases produced the overwhelming majority of the money, and whistleblowers were paid over 349 million dollars for their share, numbers that confirm the process section's premise that the government's best investigators are employees with lawyers.

The composition of those recoveries maps the risk. Recent DOJ reporting highlights Medicare Advantage risk adjustment, where diagnosis codes drive capitated payments and unsupported codes drive liability, as the growth area, alongside the durable categories: unnecessary services, substandard nursing care, opioid marketing, and kickback arrangements dressed as speaker fees, medical directorships, or rent. Health care law defense practices staff to this list, because it is next year's subpoena docket written in advance.

Criminal enforcement adds its own annual harvest. The national health care fraud takedowns announced each summer routinely charge hundreds of defendants across billions in alleged billings, telemedicine and laboratory schemes prominent in recent years, and the OIG excludes a few thousand individuals and entities from federal programs annually, the quiet sanction with the loudest commercial effect.

HIPAA enforcement statistics reward attention because they contradict the folklore. OCR's public breach portal has logged thousands of large breaches, and hacking now accounts for the overwhelming majority of exposed records, with the 2024 Change Healthcare ransomware event alone affecting on the order of a hundred million people, the largest reported health data breach in the program's history. Yet OCR's monetary settlements run only a couple of dozen per year, modest sums against the breach volume; the agency resolves most matters with corrective action, and the real financial exposure has migrated to class action litigation and state enforcement, and HIPAA enforcement has in effect become a floor beneath a much larger civil exposure. Meanwhile OCR's enforcement priorities have shifted visibly toward the right of access, penalizing providers who fail to give patients their own records promptly, a compliance item small practices still miss.

Medicare audit mathematics deserve their own line. Improper payment rates published by CMS run in the high single digits for fee-for-service Medicare, tens of billions of dollars annually, and that estimate, most of it documentation error rather than fraud, funds the entire contractor audit industry whose extrapolated demands the process section described. The distinction between improper and fraudulent is the most abused statistic in the field, and candid health care lawyers keep the two words apart.

Telehealth billing, the pandemic's legacy, added its own audit wave: utilization grew by orders of magnitude and stayed well above baseline, and the contractor reviews and fraud takedowns followed the growth, exactly as health care law practitioners predicted at the time. Remote monitoring and laboratory add-on billing now draw the same attention.

Program exclusion and licensure numbers frame individual risk. The National Practitioner Data Bank holds millions of reports, state boards discipline thousands of physicians annually, a small fraction of the licensed population, and exclusion checks against the OIG's list are now standard onboarding hygiene for every employer in the industry, because payments tied to an excluded person are themselves improper.

Two soft numbers deserve honest labeling. Estimates of total health care fraud, often quoted in the hundreds of billions, are extrapolations layered on assumptions; the verifiable figures are the recoveries and improper payment estimates above, and anything grander should be treated as advocacy. Similarly, compliance cost estimates vary too widely by methodology to quote responsibly; that the burden is large and growing is well documented, its precise size is not. The same discipline applies to any statistic quoted in a healthcare law marketing deck, this directory's included.

Read together, the numbers say enforcement is concentrated, profitable for the government, and whistleblower-driven; that privacy risk has shifted from regulators to hackers and civil litigation; and that routine documentation failure costs the system more than crime does. For a provider, the actuarial conclusion is that compliance programs and clean documentation are cheaper than any single resolved investigation. For a patient or employee holding knowledge of fraud, the numbers say the qui tam channel is real and pays. Either way, the next decision is the same one, choosing counsel who works this field daily, and that is the final section.

Health care law divides into trades that share statutes but not clients, and hiring starts with naming yours. Regulatory and transactional counsel structure deals and compliance programs for providers. Fraud defense counsel handle investigations, qui tam suits, and criminal exposure. Relator counsel represent whistleblowers on contingency. Licensure defense lawyers work the medical board. Privacy specialists run breach response. Plaintiff-side patient work, malpractice, denied claims, is a different field with its own guide on this directory. A lawyer excellent in one lane may be merely licensed in another.

For providers, the screening questions are concrete. How many OIG or DOJ investigations has the firm resolved, and in what provider segments? Has the lawyer negotiated a corporate integrity agreement, and would they say so candidly if the answer is that clients avoided one? For transactions, ask who builds the Stark and kickback analysis, a partner who works those exceptions weekly or an associate with a checklist, and whether fair market value opinions come from independent valuation firms the government has seen before.

Whistleblowers face a different market. Established relator firms work on contingency, front the costs of years under seal, and are judged by intervened outcomes; ask what share of the firm's filed cases drew government intervention, since intervention is the single most outcome-predictive event in the process. A relator also needs advice on employment exposure, retaliation protections, and the reality that most declined cases end without recovery, counsel that honest firms give before filing, in writing.

Individual clinicians should match counsel to forum. A board complaint calls for a licensure defense lawyer who knows this state's board personnel and consent order patterns, not a general litigator; a records subpoena in a fraud matter calls for defense counsel before any interview, however friendly the agents; and clinicians should know that their employer's lawyer represents the employer, a conflict that joint defense agreements manage but do not erase.

Fee structures track the lanes. Regulatory and defense work is hourly, investigations expensively so, with rates that reflect a national specialist market; licensure defense is often flat fee by stage; relator work is contingent; breach response is increasingly priced by insurers through cyber policies with panel counsel. Two cost questions belong in every engagement conversation: what does the next ninety days cost, and what event would change the estimate. Counsel who cannot answer has not scoped the matter.

Specialization signals are legible in this field. The American Health Law Association is the professional home, and speaking or writing there indicates engagement; former OIG, DOJ, or state Medicaid fraud unit lawyers populate the defense bar; certification in health care compliance marks the compliance trade. Because so much of health care law is federal, geography constrains less than in other fields, but board defense and certificate of need work remain stubbornly local, echoing the state variation section, and the state pages of this directory sort accordingly.

The interview should sound like this guide. Competent health care counsel asks early about payer mix, because Medicare and Medicaid exposure drives which statutes apply; asks who else has the documents, because parallel proceedings are the norm; asks about the sixty-day clock if an overpayment is even suspected; and talks about HIPAA obligations the moment records move. Counsel who quotes the fraud statutes but has never managed a payment suspension, or who treats a board letter as a formality, is signaling inexperience with the parts of the process that actually break clients.

Verification is the step this directory exists to make visible, and it applies with special force in a field where credentials are the product. Confirm the lawyer's bar standing and any discipline with the state bar. Confirm the firm's business registration and that its listed phone and email actually answer. Profiles here carry dated checks on each of those items, bar standing, business registration, working contact channels, refreshed on a schedule and shown with the date of the last check, so diligence is displayed rather than claimed. The habit should feel familiar: it is the same exclusion-list screening and license verification the industry performs on its own workforce, applied to the person you are about to trust with the matter.

References close the diligence. Ask for a client from a matter shaped like yours, an audit appeal, a practice sale, a board case, and ask two questions: were estimates honest, and did the firm communicate during the long quiet stretches this field's timelines guarantee. In a practice area where matters run years, responsiveness is not a courtesy, it is the service.

The loop back to the first section is direct. Health care law exists because medicine runs on other people's money under conditions of trust, and every statute in this guide, false claims, kickback, Stark, HIPAA, EMTALA, is a rule about earning that trust or paying for its breach. Choosing counsel is the same rule applied once more: verify first, document the arrangement, and trust what survives the checking.