HIPAA added 18 U.S.C. 1347 on 21 August 1996 (NHCAA), making it a crime to execute a scheme to defraud a health care benefit program "knowingly and willfully". An amendment of 23 March 2010 added subsection (b), under which no "actual knowledge of this section or specific intent" to violate it is needed.
On 23 June 2026, the Justice Department charged 455 defendants, 90 of them doctors or other licensed medical professionals, over alleged health care fraud and opioid abuse schemes involving over $6.5 billion in false claims; 295 were Medicaid defendants (DOJ). The fraud types table in what fraud is gives healthcare fraud as billing for services never performed, with health insurers as the typical victim; public programs such as Medicare are payers too.
How does one clinic turn staff hours into false claims?
Picture a clinic with four therapists billing one insurer (figures illustrative):
- Capacity. 4 therapists × 8 hours × 22 working days = 704 hours a month.
- Billed. The clinic claims 2,112 therapy hours.
- Gap. 1,408 of those hours could not have been worked.
- Money. 1,408 hours × $90 = $126,720 a month in false claims.
The insurer sees procedure codes; the money shows up at the clinic's bank. The real version, charged in 2026, is an Illinois defendant billing Medicaid for 500 or more hours of counseling and therapy a day, beyond what staff could give "even if all providers were working 24 hours per day" (DOJ, alleged). The NHCAA puts US losses in the tens of billions of dollars a year: 3 percent of health spending, conservatively, and up to 10 percent by some agencies' estimates.
From Ufuk Gürdaş, reviewer of this entry: "The cheapest healthcare fraud check a bank can run is capacity: if a clinic's monthly payer credits imply more patient hours than the staff on its onboarding file could work, some of the claims behind them cannot be true."
What does healthcare fraud mean, and how is it different from waste, abuse and insurance fraud?
Table 1. CMS's four causes of improper payment, next to two neighboring frauds.
| Term | What it is | Example | Intent |
|---|---|---|---|
| Error | A mistake (CMS) | Incorrect coding that is not widespread | None |
| Waste | An inefficiency (CMS) | Ordering excessive diagnostic tests | Not part of the definition |
| Abuse | Bending the rules, causing unnecessary program costs (CMS) | Improper billing such as upcoding | Not part of the definition |
| Fraud | An intentional deception (CMS) | Billing for services or supplies never provided | Knowing |
| Insurance fraud | Deceiving an insurer, on any line of cover | A staged crash claim | Deliberate |
| Benefit fraud | Claiming or keeping a state benefit one is not owed | Not reporting a change in circumstances | Deliberate; without it, error |
CMS calls these educational examples and says the difference between fraud and abuse "depends on specific facts, circumstances, intent, and knowledge" (Medicare Fraud and Abuse booklet, April 2026, p. 6). Section 1347's title spells it health care fraud, and 18 U.S.C. 24 defines the program as "any public or private plan or contract".
What are the main healthcare fraud schemes?
In Arizona, the 2026 takedown charged the vice president of sales at an allograft seller over kickbacks of approximately 40 percent of the price, which allegedly led to grafts on "superficial wounds that did not need this treatment". Providers billed Medicare over $4 billion for the company's allografts in about two and a half years (DOJ, alleged).
Table 2. Healthcare fraud schemes and where each is described.
| Scheme | How it works | Source |
|---|---|---|
| Phantom billing | Billing care or supplies never given, even "appointments patients don't keep" | FBI; CMS booklet, p. 5 |
| Upcoding | Billing a higher level than provided: motorized scooters billed, manual wheelchairs supplied | CMS fact sheet, July 2016, p. 2 |
| Unbundling | Billing a blood test panel test by test instead of at the panel's reduced price | CMS fact sheet, p. 3 |
| Unnecessary services | Knowingly ordering items or services the patient does not need | CMS booklet, p. 5 |
| Kickbacks | An imaging facility paying a physician for each patient referred; kickbacks also drive procurement fraud | CMS fact sheet, p. 3 |
| Self referral | A physician referring a patient for a designated health service to a clinic the physician has invested in | CMS booklet, p. 9 |
| Patient schemes | Using someone else's insurance or lending yours; visiting several doctors for controlled drug prescriptions | FBI |
What is medical identity theft?
The CMS fact sheet quotes this definition: "the appropriation or misuse of a patient's or [provider's] unique medical identifying information to obtain or bill public or private payers for fraudulent medical goods or services" (p. 1). It is identity fraud inside a health claim: a stolen identity is billed for care never given, or used to get someone else treated.
Where do the warning signs of healthcare fraud show up?
- Hours above capacity. Billed hours the staff could not have worked.
- Care during a hospital stay. The Illinois claims covered patients then in other hospitals.
- A spike in one product. A DOJ data team found the allograft cases this way.
- Paid referrals. Kickbacks to marketers and providers, about 40 percent of the price in Arizona (alleged).
- Bust out schemes. Twelve clinics billed Medicare for allografts never provided; over $27 million was seized in Florida.
- Statements that do not match. Benefit statements list care the patient never received; the FBI tells patients to check.
No single sign proves fraud.
Healthcare fraud law in the US, UK and EU: which rule needs which intent?
Table 3. Healthcare fraud law and the intent each rule needs.
| Jurisdiction | Rule | Intent element | Covers | Maximum |
|---|---|---|---|---|
| United States | 18 U.S.C. 1347 | "Knowingly and willfully"; no need to know the section or intend to violate it (1347(b)) | Any public or private health care benefit program | Fine, up to 10 years, or both; up to 20 years, or both, with serious bodily injury; any term of years or life, or both, if death results |
| United States | Anti kickback statute, Social Security Act section 1128B(b) | "Knowingly and willfully"; no need to know the section or intend to violate it (1128B(h)) | Kickbacks for referrals or orders paid by federal health care programs only | Up to $100,000, up to 10 years, or both |
| United States | 18 U.S.C. 220 | "Knowingly and willfully" | Kickbacks for referrals to a recovery home, clinical treatment facility or laboratory, any payer | Up to $200,000, up to 10 years, or both, for each occurrence |
| United States | False Claims Act, 31 U.S.C. 3729 (civil) | Knowledge, "deliberate ignorance" or "reckless disregard"; no proof of specific intent to defraud | False claims for US government money | $14,308 to $28,619 per violation plus 3 times the government's damages (28 CFR 85.5, penalties assessed after 3 July 2025) |
| United States | Stark law, 42 U.S.C. 1395nn | None for the payment ban; "knows or should know" for the penalty | Medicare referrals for designated health services to an entity the physician has a financial tie to | No payment; up to $15,000 per service |
| England, Wales and Northern Ireland | Fraud Act 2006, section 2 | "Dishonestly", intending a gain, a loss or a risk of loss | False representation, any payer | A fine, up to 10 years in prison, or both, if tried on indictment (section 1) |
| Scotland | Common law fraud (Criminal Proceedings in Scotland, Annex D) | Not given in Annex D | A fraud category beside statutory fraud | Not given in Annex D |
| United Kingdom | Bribery Act 2010, section 1 | Intending improper performance, or knowing or believing acceptance is itself improper | Offering, promising or giving a bribe | Individual: up to 10 years on indictment, a fine, or both (section 11) |
| England | Government Functional Standard 013, NHS requirements | None; a standard | NHS bodies: a board level lead; strategy and risk assessment "submitted to the centre" | No penalty in the standard |
| European Union | Directive (EU) 2026/1021, Articles 3 and 4 | "Where it is intentional" | Public and private sector bribery, no EU healthcare fraud offense; Ireland in (recital 49), Denmark not bound (recital 50) | In national law by 1 June 2028; maximum of at least 5 years where an official breaches duty, otherwise at least 3 (Article 12(2)) |
Section 1347 and the anti kickback statute need "knowingly and willfully", though not proof that the defendant knew the statute; the False Claims Act reaches reckless disregard, and the Stark payment ban needs no intent.
Sections 1 to 9 of the Fraud Act extend to England and Wales and Northern Ireland only (section 15(2)). Under 18 U.S.C. 24, wire fraud is a federal health care offense when it relates to a health care benefit program.
Who finds healthcare fraud: payers, agencies or banks?
Payers can stop the money: in the takedown, CMS suspended 1,079 providers and revoked billing privileges for 1,403. The FBI calls itself the primary agency for investigating healthcare fraud in federal and private insurance programs. In the takedown it worked beside the HHS Office of Inspector General and DOJ's Health Care Fraud Unit, whose strike forces were among the prosecutors.
HHS OIG's fiscal year 2025 chart shows state Medicaid Fraud Control Units with 856 fraud convictions, the most in Pennsylvania (107), Texas (75) and Florida (68).
Each UK nation has its own NHS counter fraud body:
- England. The NHS Counter Fraud Authority.
- Wales. NHS Counter Fraud Service Wales.
- Scotland. Counter Fraud Services at NHS National Services Scotland.
- Northern Ireland. Counter Fraud and Probity Services at the Business Services Organisation.
The NHS Counter Fraud Authority's Strategic Intelligence Assessment 2026 estimates £1.301bn of NHS funding is vulnerable to loss through fraud, bribery and corruption in England in 2025 to 2026, £268.76m of it to patient exemption fraud.
What happens to the money, and what does a bank see?
The Illinois defendant allegedly diverted over $27 million to brokerage accounts, $10 million to a luxury car dealership he set up and $4 million to real estate and home improvements. His bank would see Medicaid credits arrive and those transfers leave. 18 U.S.C. 1956(c)(7)(F) makes a federal health care offense a specified unlawful activity, so moving the proceeds can be laundering too (see fraud vs money laundering).
complead, formerly Sanction Scanner, offers bank transaction fraud monitoring: each inbound and outbound transfer is scored before it completes, with payer, payee and any intermediary bank checked. A high score warns the sender or holds the transfer, and the fraud team decides. Because onboarding, screening, monitoring, fraud and investigation sit on one complead engine, a clinic customer carries one risk score across all of them.
If you bank clinics, two checks fit into this week: set last month's payer credits for each clinic against the staff on its file, and list the customers that pay marketers per patient. Then confirm where your report goes: the NHS counter fraud body for that nation, or the FBI's IC3 form.
Related terms
- Insurance fraud. Deceiving an insurer for a payment or price.
- Benefit fraud. Taking a state benefit one is not owed.
- Wire fraud. A scheme to defraud by wire, radio or television.
- Identity fraud. Using another person's details for gain.
- Procurement fraud. Bid rigging, kickbacks or false invoices in buying.
