The American Health Law Association (AHLA) held its annual Fraud and Compliance Forum in Washington, DC on September 23 and 24, 2026. The conference featured robust panel discussions with government representatives, law enforcement, defense attorneys, corporate in-house counsel, compliance officers, and others in the health care field. Notably, the key themes of this conference focused on collaboration across governmental agencies, data, artificial intelligence (AI) and proactivity rather than reactivity in a data-driven enforcement era.
Fireside Chat with OIG, HHS and CMS Leaders
A highlight of the conference was a fireside chat with leaders from OIG, HHS, and CMS: Brenna Jenny (moderator); DOJ Deputy Assistant Attorney General in the Commercial Litigation Branch – Civil Division; Kim Brandt, CMS Deputy Administrator and COO; Susan Gillin, DHHS Office of the Inspector General Assistant Inspector General for Legal Affairs; and Beth Kelley, DHHS Office of the Inspector General Acting Deputy General Counsel. The fireside chat underscored the increasingly sophisticated and coordinated efforts by CMS, OIG, and HHS to combat health care fraud in today’s technology-driven world. The panel members kicked off the AHLA forum by focusing on a premise that radiated across the conference: As fraud schemes become more complex, government enforcement tools are also becoming more advanced, with greater reliance on data analytics, cross-agency collaboration, and proactive provider oversight.
The key discussion was on the expansion of targeted and collaborative fraud initiatives, with an emphasis on data and AI. Officials emphasized that as fraudsters are becoming increasingly sophisticated, the government is evolving its own detection capabilities. Specifically, there was an emphasis on the CMS-led Medicaid Fraud War Room (War Room), which brings together federal and state partners to rapidly detect, investigate, and halt Medicaid-specific fraud. This is one of the most significant examples of proactive federal-state collaboration to date.
Agency leaders also pointed to provider enrollment moratoria as an example of successful proactive enforcement. A six-month moratorium affecting durable medical equipment (DME) suppliers recently expired, and CMS credited the moratorium and related enforcement actions with preventing approximately $1.5 billion in improper expenditures. CMS also reported that the current home health and hospice moratoria, which remain in effect through November, have contributed to a decline in fraudulent billing and are under consideration for extension.
The panelists made clear that the War Room, moratoria, and other improved and technology-focused analytical techniques and tools have enabled earlier identification of problematic providers and more efficient development of cases.
Importantly, the panelists noted trends in regulatory enforcement: skin substitute billing, DME, home health, hospice, and Medicaid services. In pursuing these areas, it is clear that regulators are rapidly moving away from a traditional “pay and chase” enforcement model toward a proactive “detect and prevent” strategy, which is driven by data analytics, interagency collaboration, and provider enrollment controls.
Panelists emphasized several compliance fundamentals that providers should prioritize to avoid becoming future enforcement targets. Agencies stressed the importance of understanding and vetting health care company employees, conducting appropriate diligence on individuals and entities involved in patient care and operations, robust documentation and clear supporting records of medical necessity, eligibility, discharge decisions, regular internal audits, and more. Providers should also take any corrective action plans seriously when offered the opportunity and ensure strict compliance with regulatory deadlines. These actions, along with other proactive measures, were presented as the most effective way to minimize enforcement risk in an environment of increasingly sophisticated government oversight.
Keynote Discussion: Criminal and Civil Enforcement and Legal Developments
Another highlight of the conference was a keynote discussion regarding criminal and civil enforcement, along with legal developments, in the health care space. The panel consisted of former DOJ enforcement attorneys, including former Deputy Assistant Attorneys General. The panel members discussed the DOJ’s unprecedented restructuring efforts, uncertainty surrounding civil and criminal enforcement authority, the growing role of data-driven whistleblower cases, and practical considerations for organizations navigating disclosure and compliance decisions.
DOJ’s National Fraud Enforcement Division Represents a Historical Structural Shift
The conference highlighted the DOJ’s rapid creation of the National Fraud Enforcement Division (NFED) and what that development signals about this administration’s enforcement priorities. Panelists emphasized that the speed and scope of the reorganization are unlike anything seen in recent decades. Following announcements in early 2026, the DOJ consolidated several enforcement functions into NFED, including the Health Care Fraud Unit, Tax Division components, and other government fraud enforcement teams. The new division reportedly includes approximately 500 attorneys and staff, with plans for further hiring and expansion. While fraud enforcement is still a clear priority, the reorganization has created uncertainty surrounding enforcement authorities and where organizations should turn for disclosure.
Questions Remain Regarding Civil and Criminal Enforcement Authority
While NFED was primarily designed as a criminal enforcement division, panelists repeatedly noted that the boundaries between civil and criminal authorities remain unsettled. Recent DOJ guidance suggests that NFED may have authority to handle certain False Claims Act (FCA) matters directly. In addition, the DOJ directed a review of whether additional noncriminal enforcement functions should ultimately be moved into the new structure.
Although the DOJ has not yet announced any transfer of the Civil Fraud Section responsibilities, panelists observed that NFED’s authority could increasingly intersect with traditional civil health care fraud enforcement.
This uncertainty has meaningful implications for health care providers evaluating the following:
- Self-disclosure obligations
- Parallel civil and criminal investigations
- Cooperation strategies
- Resolution and settlement negotiations
Historically, organizations could often begin discussions with civil enforcement authorities before determining whether criminal exposure existed. Several panelists noted that the new structure creates uncertainty regarding where disclosures should be directed and how organizations should approach matters that contain both civil and criminal exposure. Organizations contemplating self-disclosure may face a less predictable process than in prior years.
Data Mining is Reshaping the FCA Landscape
Consistent with the themes discussed throughout the conference, the panel focused on the growth of data-driven investigations and qui tam filings. Panelists observed that the DOJ, whistleblowers, and private analytics companies increasingly rely on sophisticated data analysis to identify potential fraud indicators. Health care organizations should assume that the same publicly available data they can access is being reviewed by relators, analytics firms, competitors, and government investigators. Data shows that approximately 45% of qui tam complaints are reportedly associated with some form of data-driven analysis. The DOJ continues to express interest in data-supported allegations, particularly those involving significant statistical anomalies. However, the safeguard for organizations is that while data is extremely important and an area of focus right now, data alone remains insufficient to establish FCA liability because scienter and other statutory elements require additional evidence.
Therefore, organizations should conduct routine internal data audits; identify reimbursement or billing outliers before third parties do, as decisions regarding what to do with the reimbursement or billing outliers will be just as important as knowledge of the outliers; understand what publicly available datasets could be used to evaluate organizational conduct; develop escalation protocols for data-based allegations; and create a process for rapid response when inquiries arise. Organizations should be proactively analyzing their own data using the same methods increasingly employed by relators and enforcement agencies.
Conference Highlights
Beyond the fireside chat and keynote discussion, the conference featured panel discussions on a variety of topics, including the following:
The Enforcement and Integration of Data Analytics and AI: This session highlighted hot spots for federal scrutiny, how health care enforcement is increasingly driven by data, AI, and interagency information sharing and collaboration. The presenters also provided practical compliance tips for health care providers, suggesting proactivity over reactivity.
Recent regulatory audits and investigations signal where federal scrutiny and enforcement in the health care industry is headed next. The hot spots include remote patient monitoring, telehealth, Medicare Advantage risk adjustment, durable medical equipment (DME), and opioid-related services. These areas are viewed as higher-risk because of recurring concerns such as unsupported diagnoses, fabricated medical necessity, ghost patients, undelivered equipment, and improper prescribing practices.
In regulating these areas, and others, enforcement has entered a new “data-first” era in which government agencies use large-scale analytics and AI to identify suspicious activity. An important tool created as part of this era is the DOJ’s Health Care Fraud Data Fusion Center, an AI-enabled initiative that combines data and resources from agencies such as the DOJ, HHS-OIG, FBI, CMS, DHS, and FTC and then uses AI and advanced analytics to detect suspicious behavior across federal health care programs in near real time. Its mission involves breaking down data silos among federal partners to proactively identify anomalous billing patterns and emerging fraud schemes. These progressive efforts have resulted in record enforcement activity, including DOJ major health care fraud takedowns and billions of dollars in FCA recoveries.
The panelists noted, though, that AI is not just a tool increasingly used by regulators to identify potentially fraudulent behavior. It is also being used by individuals to perpetrate fraud. Bad actors are using generative AI to create fabricated clinical documentation, synthetic patient identities, cloned voices, and other convincing evidence to support false claims.
In today’s data-centered world, providers should focus on proactive steps to find and fix risk before regulators do. This proactivity should include conducting regular self-audits, deploying the same types of outlier analytics used by regulators, moving toward pre-payment review processes, validating that encounters and documentation are authentic, and closely monitoring performance indicators that may reveal compliance risks.
Managing Technology in Health Care: This panel focused on how health care organizations are rapidly adopting AI, the regulatory and enforcement risks associated with that adoption, and best practices for governance and compliance.
Clinical applications of AI in health care are seen now more than ever. This includes diagnostic support, predictive analytics, ambient clinical documentation tools, and AI-enabled imaging technologies. AI is also being used for administrative tasks, such as revenue cycle management, coding support, prior authorization automation, workforce scheduling, patient engagement, and more. These technologies can improve efficiency, reduce clinician burnout, increase revenue, and enhance patient experiences when implemented and used appropriately.
While federal agencies, including HHS, FDA, CMS, CDC, and OIG, are also increasingly using AI, this administration has been relatively silent on its views of regulating the ever-increasing use of technology. As a result, some states are enacting their own AI laws, creating a patchwork of requirements concerning disclosure, consent, transparency, clinician oversight, and restrictions on AI-driven care decisions. At this point, there is an air of uncertainty surrounding whether future federal action may preempt certain state regulations, making compliance planning particularly challenging.
With the increase of data and AI across the health care field, regulators are closely scrutinizing AI-related activities, looking at not only fraud and abuse but also patient well-being and care quality. This focus results in regulators considering where technology could influence referrals, reimbursement, coding accuracy, access to care, and patient outcomes. Potential concerns include AI-generated coding that leads to improper billing, algorithms that steer patients based on financial incentives rather than clinical need, and biased models that could result in discriminatory care recommendations.
Providers and health care organizations should analyze and mitigate risk in this data-focused era, creating structured AI governance frameworks in best efforts to comply with today’s technology-driven world. Organizations should evaluate AI tools based on risk level, with the highest scrutiny applied to systems involved in clinical decision-making and patient care. Core governance elements include privacy and security protections, transparency, human oversight, bias assessment, ongoing monitoring, clinician validation, staff education, and multidisciplinary review committees. While AI can provide significant value in health care, successful implementation requires thoughtful governance that prioritizes patient safety, privacy, compliance, and ethical use.
Disclosure: Panelists explored the increasingly complex question facing health care organizations when potential compliance issues arise: whether, when, and where to self-disclose. Against a backdrop of record FCA activity, the presenters highlighted that health care-related FCA enforcement remains a significant government priority, with FY 2025 producing record health care recoveries and a substantial increase in qui tam filings. The discussion emphasized that self-disclosure is no longer simply a compliance consideration but a strategic decision that can materially affect an organization’s exposure, resolution options, and relationship with enforcement authorities. As whistleblower activity continues to increase and government agencies expand incentives for internal reporting, health care providers should expect that issues identified internally may ultimately come to the government’s attention regardless of whether the organization chooses to disclose.
A central theme of the presentation was the growing significance of the DOJ’s 2026 Corporate Enforcement and Voluntary Self-Disclosure Policy (CEVSDP), which provides meaningful incentives for timely disclosure, full cooperation and effective remediation, including the potential for declinations, reduced penalties, and non-prosecution agreements. Presenters stressed that organizations must carefully evaluate the nature of the underlying conduct when selecting among the available disclosure pathways, including DOJ, HHS-OIG, and CMS protocols, because each program serves different purposes and offers different benefits and limitations. Equally important, organizations should conduct a thorough internal investigation before making disclosure decisions, including assessing the scope of the conduct, calculating potential damages, identifying root causes, preserving privilege, and implementing corrective action. The presenters repeatedly emphasized that timing is critical, particularly given the DOJ’s focus on prompt reporting and its creation of a 120-day whistleblower safe harbor, making robust compliance reporting channels and rapid internal escalation procedures more important than ever.
Ultimately, the panel cautioned that self-disclosure is not without risk. Voluntary disclosure can trigger significant cooperation obligations, expose an organization to broader government scrutiny, and create reputational concerns. However, failing to disclose may result in the loss of cooperation credit, more severe enforcement outcomes, and diminished ability to control the timing and narrative of an investigation. The presenters’ practical takeaway was that health care organizations should evaluate disclosure decisions through a multidisciplinary lens involving legal, compliance, operational, and governance stakeholders, while ensuring their compliance programs, internal reporting mechanisms, and investigative protocols are sufficiently mature to respond quickly when potential misconduct is identified.
Medicaid Fraud: Panelists highlighted the significant policy and enforcement changes affecting Medicaid providers, beginning with this administration’s implementation of new Medicaid “community engagement” requirements. Under the recently issued CMS interim final rule, certain Medicaid expansion beneficiaries will be required to satisfy work, education, or community service requirements unless they qualify for an exemption, including for pregnancy, disability, caregiving responsibilities, substance use disorders, or certain medical conditions. Providers are expected to play a critical role in documenting and supporting exemption requests, particularly for individuals claiming “medical frailty” or an inability to satisfy the program’s requirements. Panelists cautioned that the rule effectively places providers in the position of evidentiary gatekeepers without a uniform federal documentation standard, creating potential compliance and fraud risks as beneficiaries increasingly seek certifications of work exemptions. The presenters emphasized the importance of developing documentation standards, oversight mechanisms, and review processes before state implementation deadlines take effect.
The panel also discussed broader Medicaid program integrity trends. Despite redeterminations following the COVID-19 continuous enrollment period, Medicaid enrollment remains above pre-pandemic levels, and regulators continue to focus on reducing improper enrollment and spending. Medicaid improper payments exceeded $37 billion in fiscal year (FY) 2025, prompting increased scrutiny of several service lines that regulators have identified as high risk. Current enforcement attention is focused on: (1) housing stabilization services, where investigators have alleged fabricated eligibility and service documentation; (2) behavioral health services, where audits have identified widespread documentation deficiencies and unsupported billing; (3) personal care attendant services, which remain one of the largest sources of Medicaid fraud convictions and are increasingly monitored through electronic visit verification systems; and (4) nonemergency medical transportation, where claims are being closely evaluated against underlying medical services and transportation records. Across these areas, regulators are increasingly relying on data analytics, claims-based audits, and cross-referencing multiple data sources to identify potential fraud, waste, and abuse.
Finally, speakers noted that Medicaid investigations are increasingly being driven by whistleblowers, data mining, interagency information sharing, and sophisticated claims analytics. The federal government’s 2026 enforcement posture reflects greater use of payment suspensions, targeted reviews of high-risk claims, and heightened oversight of Medicaid Fraud Control Units themselves. The panel’s key takeaway for providers was that successful compliance efforts now require more than simply maintaining documentation. Organizations should proactively review whether claims, time records, authorizations, clinical documentation, credentialing records, exclusion screenings, and ownership disclosures align before an audit or investigation occurs. With regulators increasingly focused on operational details and documentation integrity, providers should expect continued scrutiny and take steps to identify and remediate vulnerabilities before they become the subject of government inquiries or whistleblower allegations.
The False Claims Act Litigation Developments: This panel specifically addressed recent developments in the FCA arena. The panelist described an enforcement environment that remains highly active and increasingly consequential for health care organizations. Health care-related FCA recoveries exceeded $5.7 billion in FY 2025, while whistleblowers filed a record 1,297 qui tam actions, underscoring the continued prominence of FCA litigation as a government enforcement tool.
The presentation focused on ongoing constitutional challenges to the FCA’s qui tam provisions. In United States ex rel. Zafirov v. Florida Medical Associates, the Eleventh Circuit reversed a district court decision that had found the qui tam provisions unconstitutional under the Appointments Clause. The appellate court concluded that relators do not occupy a “continuing position” within the government because their role is tied to a single case, is temporary in nature, and does not carry the indicia of a federal office. Importantly, however, the court remanded the case for consideration of additional constitutional arguments under the Take Care Clause and Vesting Clause, leaving open broader questions about the extent to which private relators may exercise executive enforcement authority on behalf of the United States. The panel noted that these constitutional issues are likely to continue percolating through the federal courts and could ultimately attract further appellate or Supreme Court attention.
The panel also discussed another closely watched case in the evolving constitutional debate surrounding qui tam actions, United States ex rel. Penelow v. Janssen Products, L.P., currently pending before the Third Circuit. Although a decision has not yet been issued, the case presents an opportunity for another federal appellate court to weigh in on challenges to the FCA’s qui tam framework and could contribute to an emerging circuit split regarding relators’ authority to pursue claims on behalf of the government.
Lastly, the panelist highlighted that courts continue to refine the pleading and proof standards applicable to FCA cases. Courts appear increasingly focused on whether plaintiffs can plead specific facts demonstrating knowledge and causation, while also signaling that ambiguity in statutes or regulations may not provide a complete defense where evidence suggests a party understood the risk of noncompliance. For health care providers, the overarching takeaway is that FCA litigation continues to evolve rapidly, requiring careful attention to compliance, documentation, physician compensation arrangements and emerging legal developments that could influence both enforcement activity and litigation strategy, but also to legal developments that may significantly influence the future scope and operation of FCA enforcement.
