The U.S. Department of Justice's 2026 National Health Care Fraud Takedown charged 455 defendants in schemes involving more than $6.5 billion in false claims. It also marked the first prosecution to come out of the DOJ's new Health Care Fraud Data Fusion Center, which uses AI and advanced analytics to spot fraudulent billing patterns in real time.
That case, a $67 million scheme to bill Illinois Medicaid for behavioral health services never provided, went from data analysis to charges in five days. The defendant was arrested within seven months. For healthcare organizations, the message is clear: AI is now the government's most powerful fraud detection tool, and it is also creating new False Claims Act exposure when AI-assisted processes produce inaccurate claims or unsupported diagnoses.
The government's AI enforcement arsenal
The Data Fusion Center combines experts from the DOJ Health Care Fraud Unit's Data Analytics Team, the Department of Health and Human Services Office of Inspector General, the FBI, and other federal agencies. The Centers for Medicare & Medicaid Services said it will provide cloud computing space within its integrated data repository to support DOJ analytics, effectively building enforcement tools into the healthcare payment system itself.
CMS Administrator Dr. Mehmet Oz described the shift in approach: "Prosecuting criminals who steal from American patients is necessary, but stopping them before a single dollar leaves the building is smarter. CMS is done playing catch-up."
The numbers back that up. On June 23, 2026, CMS said it suspended 1,079 providers, revoked billing privileges for 1,403 providers, and obtained more than $73 million in Civil Monetary Payment settlements with more than 1,400 exclusions. HHS-OIG is seeking more than $10 billion from payments CMS blocked before they were paid.
DOJ announced on January 16, 2026, that False Claims Act settlements and judgments exceeded $6.8 billion in fiscal year 2025, the highest annual total in the statute's history. More than $5.7 billion came from healthcare matters, and qui tam lawsuits hit a record 1,297.
The DOJ-HHS False Claims Act Working Group, launched in July 2025, formalizes shared investigative strategies between agencies and channels whistleblower complaints toward priority enforcement theories.
Three theories of AI-related FCA liability
AI does not change the FCA's knowledge standard. But organizations that deploy AI systems without adequate validation, monitoring, or oversight may face allegations that they acted with reckless disregard of the truth or falsity of claims submitted to federal programs.
EHR manipulation and AI-driven upcoding. The DOJ-HHS FCA Working Group named "manipulation of Electronic Health Records systems to drive inappropriate utilization of Medicare covered products and services" as one of its six priority enforcement areas. HHS-OIG's Medicare Advantage Industry Segment-Specific Compliance Program Guidance, released February 3, 2026, flagged "querying physicians via electronic medical record platforms (including prompts generated by artificial intelligence algorithms)" as "potentially abusive and fraudulent conduct." The guidance also called out in-home health risk assessments used primarily to capture diagnosis codes and failure to delete unsupported diagnosis codes.
AI-facilitated enrollment and identity fraud. The Troy Health Non-Prosecution Agreement, dated August 14, 2025, was the first NPA issued under DOJ's updated Corporate Enforcement and Voluntary Self-Disclosure Policy. According to the NPA, Troy used an AI-based platform to scale fraudulent cold-calling of Medicare beneficiaries using pharmacy-sourced customer lists obtained without consent. In the 2025 National Health Care Fraud Takedown, defendants allegedly used AI to create fake recordings of Medicare beneficiaries purportedly consenting to receive products, resulting in roughly $703 million in allegedly fraudulent claims.
The regulatory gap as FCA opportunity. There is no comprehensive federal AI regulatory scheme. NIST and other organizations have issued AI governance principles, but they are high-level and don't specify industry compliance requirements. That uncertainty creates room for DOJ and qui tam relators to test existing FCA theories in AI-related contexts, adapting frameworks like false payment data and failure to meet contracted specifications to AI products.
The DOJ's Evaluation of Corporate Compliance Programs already encourages companies to manage "emerging risks" including AI, creating an expectation that organizations assess and manage AI-related compliance risks.
The payer side: AI in utilization management
Insurers and Medicare Advantage Organizations using AI for utilization management face their own exposure, a mirror image of provider-side risk. States have enacted laws requiring human oversight for AI-driven adverse determinations. California's SB 1120 (2024) regulates AI in utilization review. Illinois' HB 1806 (2025) prohibits AI from providing therapy services or generating treatment plans without licensed professional review.
Federal regulations already constrain purely algorithmic decision-making. Under 42 CFR § 422.566(d), if an MA organization expects to issue a partially or fully adverse medical necessity decision, the determination "must be reviewed by a physician or other appropriate health care professional with expertise in the field of medicine or health care that is appropriate for the services at issue" before it is issued. Section 422.562(a)(4) requires each MA organization to employ a medical director responsible for "ensuring the clinical accuracy of all organization determinations and reconsiderations involving medical necessity." And 42 CFR § 422.101(c)(1) requires medical necessity determinations to be based on "the enrollee's medical history (for example, diagnoses, conditions, functional status), physician recommendations, and clinical notes."
These provisions require coverage denials to be individualized, clinician-reviewed, and grounded in enrollee-specific clinical information. Autonomous algorithmic systems cannot satisfy that standard. Where AI systems generate adverse determinations without physician review, MAOs face CMS enforcement, state regulatory liability, and potential reverse FCA exposure if algorithmic denials drive improper retention of capitated payments.
Additionally, 42 CFR § 422.101(b)(6) permits internal coverage criteria only when criteria are "not fully established" in applicable statutes, regulations, National Coverage Determinations, or Local Coverage Determinations, and requires those criteria to be evidence-based and publicly accessible. AI systems applying opaque proprietary criteria to deny coverage may conflict with these requirements.
Practical steps for healthcare organizations
Healthcare organizations should prepare to defend their own AI use and deploy analytics internally to detect issues before the federal government does. That means mapping all AI tools touching clinical documentation, coding, billing, risk adjustment, and claims processing. It means establishing an AI governance policy with compliance, clinical, legal, and IT representation, documenting algorithm provenance, validation, and ongoing monitoring.
For MAOs, 42 CFR § 422.566(d) makes human review a regulatory mandate: adverse medical necessity determinations must be reviewed by a qualified health care professional before issuance. For providers, the MA ICPG signals that perfunctory sign-off on AI-generated prompts won't satisfy regulators.
Organizations should also use the same data analytics tools DOJ deploys to audit their own billing patterns for outliers. Proactive self-auditing demonstrates good faith and may support voluntary self-disclosure. Vendor contracts should address model performance representations, audit rights, data provenance, compliance obligations, indemnification, cooperation during investigations, and retention of records needed to validate AI-generated outputs.
Internal investigation protocols and response teams must be pre-established. The Data Fusion Center moved from analysis to prosecution in days. And organizations should maintain records demonstrating when clinicians reviewed, modified, or rejected AI-generated recommendations. That documentation may become critical in defending government investigations or relator allegations.
Why this matters for healthcare professionals
The same AI tools that flag suspicious billing patterns for federal investigators can flag them for you first. Healthcare compliance officers, revenue cycle leaders, and clinical informatics teams should treat AI governance as an operational priority, not a legal afterthought. The regulatory requirements are already on the books for Medicare Advantage: physician review of adverse determinations, individualized medical necessity decisions, and documented clinical oversight. Providers using AI for documentation and coding should assume those same standards will be applied to them, and they should audit their AI outputs now, before a Data Fusion Center analysis does it for them.
For professionals looking to build these skills, AI for Healthcare training covers compliance and practical applications for medical organizations. Legal and compliance teams may also benefit from AI for Legal resources focused on regulatory oversight and liability frameworks.
Your membership also unlocks:
