Summary. Three federal statutes govern nearly every financial arrangement in American healthcare, on assumptions alien to the rest of commercial law. The Anti-Kickback Statute makes it a felony to pay for a referral, with no requirement that the payment be unreasonable or that anyone be harmed. The Stark Law strictly forbids a physician from referring designated health services to an entity with which the physician has a financial relationship unless an exception fits exactly. The False Claims Act converts violations of either into treble damages plus per-claim penalties, enforced largely by private whistleblowers who share in the recovery. This article covers how the three interact, what the safe harbors and exceptions require, how Escobar and Schutte reshaped materiality and scienter, and what to do on discovering a problem.

A cardiology group and a community hospital do something entirely ordinary. The hospital wants the group's physicians to serve as medical directors of its cardiac service line. It pays each of four physicians $60,000 a year for eight hours of monthly administrative work. The rate was set by a compensation consultant, benchmarked to the 75th percentile of a national survey. Everyone signed a written agreement. Nobody discussed referrals.

Four years later a former practice administrator files a sealed complaint. The government intervenes. The theory is not that the rate was too high — the benchmark data holds up. It is that the physicians did not perform the work. There are no time records, no meeting minutes, no reports, and the service line's committee met twice in four years. The hospital paid $960,000 for services it cannot show it received, to physicians who referred it roughly $19 million in cardiac procedures.

That is the case. Not an inflated rate — a documentation vacuum where the services should have been. Because Stark is strict liability and the personal services exception requires that the compensation be for identifiable services actually furnished, the exception fails. Because the exception fails, every referred designated health service claim was not payable. Because those claims were submitted anyway, the False Claims Act applies, and its damages are three times the government's payments plus a penalty for each of tens of thousands of claims.

The exposure that begins as a $960,000 arrangement ends in the tens of millions. The hospital's general counsel will say, accurately, that nobody intended anything wrong. Under Stark, intent was never an element.

That gap — between how healthcare executives think about financial arrangements and how these three statutes actually operate — is what this article is about.

Why healthcare is different

Ordinary commercial law assumes that paying for referrals is not merely lawful but the basis of an entire economy. Finder's fees, sales commissions, affiliate marketing, and referral bonuses are unremarkable. In healthcare, the same conduct is a felony.

The reason is a structural feature of the system: the person who chooses the service (the physician) is not the person who pays for it (Medicare, Medicaid, or a commercial insurer), and frequently not the person who receives it (the patient makes the appointment, but the physician decides what is medically necessary). Ordinary market discipline — the buyer's price sensitivity — is absent. A payment that gives the decision-maker a financial stake in the choice therefore has no counterweight.

Congress responded with prohibitions calibrated to that structure. They are broad, they contain few defenses, and two of the three do not require proof of harm.

The Anti-Kickback Statute

42 U.S.C. § 1320a-7b(b) makes it a felony to knowingly and willfully offer, pay, solicit, or receive any remuneration, directly or indirectly, overtly or covertly, in cash or in kind, to induce or reward:

  • referrals of an individual for any item or service payable by a federal health care program, or
  • the purchasing, leasing, ordering, or arranging for or recommending any item or service payable by such a program.

Five features make it far broader than it looks.

"Remuneration" means anything of value. Not just cash. Free or below-market rent, free staff, free equipment, waived rent escalation, meals, travel, entertainment, discounted services, consulting fees, medical directorships, speaker fees, research grants, the free use of a conference room, subsidized electronic health record software, a favorable joint venture return, a loan on soft terms, a waived copayment. Anything of value flowing in either direction.

The "one purpose" test. Under United States v. Greber, 760 F.2d 68 (3d Cir. 1985), and the circuits that followed it, a payment violates the statute if one purpose of the payment is to induce referrals, even if it also compensates legitimate services and even if the compensation is at fair market value. This is the single most important doctrine in the statute and the one most often misunderstood. A medical directorship can be fully earned, entirely reasonable, and priced correctly, and still violate the statute if the hospital chose that physician because of referrals.

Both sides are liable. The payor and the recipient both commit the offense. A physician who accepts an improper payment is as exposed as the entity that paid it.

Criminal, civil, administrative, and FCA. A violation carries up to ten years' imprisonment and a $100,000 fine per violation, civil monetary penalties, mandatory or permissive exclusion from federal health care programs under 42 U.S.C. § 1320a-7 — which is generally fatal to a healthcare business — and, since the 2010 amendment, a claim "resulting from" a violation is a false claim for FCA purposes. 42 U.S.C. § 1320a-7b(g).

Scienter is relaxed. The statute requires "knowingly and willfully," but § 1320a-7b(h) provides that a person need not have actual knowledge of the statute or specific intent to violate it. Ignorance of the Anti-Kickback Statute is not a defense to it.

Safe harbors

Recognizing that the prohibition would otherwise sweep in ordinary and beneficial arrangements, the Department of Health and Human Services promulgated safe harbors at 42 C.F.R. § 1001.952. There are more than thirty. The important structural points:

Safe harbors are voluntary, and failing one is not a violation. An arrangement that fits a safe harbor is immune. An arrangement that does not fit is evaluated on the facts, under the one-purpose test. This is the opposite of Stark, where a failure to fit an exception is itself the violation.

Compliance must be complete. Partial compliance is no compliance. If the safe harbor requires a one-year term and the agreement has a six-month term, the safe harbor is unavailable — not partly available.

The safe harbors most often used:

Personal services and management contracts — a signed writing covering all services, specifying them; a term of at least one year; aggregate compensation set in advance, consistent with fair market value in an arm's-length transaction, and not determined in a manner that takes into account the volume or value of referrals; services not exceeding what is reasonably necessary; and, if the services are on a periodic or part-time basis, a schedule of the intervals, their precise length, and the exact charge for each. A 2020 amendment added an alternative outcomes-based-payment safe harbor and relaxed the aggregate-compensation requirement to permit a methodology set in advance.

Space and equipment rental — a signed writing, a term of at least one year, aggregate rent set in advance at fair market value without regard to referrals, and space not exceeding what is reasonably necessary. The pitfall is per-click or percentage-of-revenue rent, which fails.

Employment — bona fide employees are broadly protected, which is why an employed physician's productivity compensation raises different questions from a contractor's.

Investment interests — with different tests for publicly traded entities and small entities, the latter requiring that no more than 40 percent of investment interests be held by referral sources and no more than 40 percent of gross revenue come from them, with no differential terms or financing tied to referral volume.

Discounts, group purchasing organizations, warranties, referral services, practitioner recruitment in underserved areas, electronic health records items and services, value-based arrangements (added in 2020 in three tiers of increasing risk assumption), and patient engagement and support tools.

Advisory opinions. The HHS Office of Inspector General issues binding advisory opinions on proposed or existing arrangements under 42 C.F.R. Part 1008. They bind only the requesting party but are the closest thing available to certainty, and the published opinions are the best guide to how OIG reasons about novel arrangements. OIG also publishes Special Fraud Alerts and Special Advisory Bulletins naming arrangements it considers suspect — speaker programs, telefraud arrangements, and certain physician-owned distributorships among them.

EKRA

The Eliminating Kickbacks in Recovery Act, 18 U.S.C. § 220, enacted in 2018, prohibits remuneration for referrals to recovery homes, clinical treatment facilities, and laboratories — and it applies to all payors, not just federal programs. Its safe harbor for employee compensation is narrower than the Anti-Kickback Statute's: it does not protect compensation that varies by the number of individuals referred, tests ordered, or amounts billed. Laboratories that pay commission-based sales compensation lawful under the AKS employment safe harbor have been prosecuted under EKRA.

The Stark Law

42 U.S.C. § 1395nn is a different kind of statute, and the difference matters more than any detail within it.

The prohibition. If a physician (or an immediate family member) has a financial relationship with an entity, the physician may not make a referral to that entity for the furnishing of designated health services payable by Medicare, and the entity may not bill for those services — unless an exception applies.

Strict liability. There is no intent element in the referral prohibition. A well-meaning arrangement that fails an exception by a technicality is a violation. Compare the Anti-Kickback Statute, where intent is everything, and note that the two statutes require opposite analytical postures: under the AKS you ask why; under Stark you ask whether the arrangement fits.

Designated health services are enumerated: clinical laboratory services; physical therapy, occupational therapy, and outpatient speech-language pathology; radiology and certain other imaging services; radiation therapy services and supplies; durable medical equipment and supplies; parenteral and enteral nutrients, equipment, and supplies; prosthetics, orthotics, and prosthetic devices and supplies; home health services; outpatient prescription drugs; and inpatient and outpatient hospital services. Note the last item — for a hospital, essentially everything is a DHS.

Financial relationship means an ownership or investment interest or a compensation arrangement, direct or indirect. "Indirect" reaches through chains of entities, and the indirect compensation analysis is where sophisticated structures fail.

Consequences. Denial of payment for the referred services; refund of amounts collected; civil monetary penalties for knowing violations, and substantially higher penalties for circumvention schemes; exclusion; and — critically — False Claims Act liability, because a claim for a service referred in violation of Stark is not payable, and submitting it while certifying compliance is the theory that produced the largest healthcare settlements on record. United States ex rel. Drakeford v. Tuomey, 792 F.3d 364 (4th Cir. 2015), affirmed a judgment exceeding $237 million against a hospital whose part-time employment agreements with surgeons failed Stark.

Exceptions

The exceptions appear at 42 C.F.R. §§ 411.355–411.357, grouped as exceptions applicable to both ownership and compensation, ownership-only exceptions, and compensation-only exceptions. The recurring elements:

  • A writing, signed by the parties, describing the arrangement. (The 2021 rules relaxed the signature timing, permitting signatures within 90 consecutive days.)
  • A term of at least one year in many exceptions.
  • Compensation set in advance, at fair market value, and not determined in a manner that takes into account the volume or value of referrals or other business generated between the parties.
  • Commercial reasonableness — the arrangement makes sense as a business matter even absent referrals. The 2021 rules clarified that an arrangement may be commercially reasonable even if it results in a loss to one party.
  • The arrangement does not violate the Anti-Kickback Statute (in some exceptions).

The most-used exceptions:

Bona fide employment — a salary that is fair market value and does not vary with referrals of DHS (though productivity bonuses based on the physician's personally performed services are permitted).

Personal service arrangements — the exception that failed in the opening example.

Rental of office space and equipment — with the same per-click and percentage prohibitions.

In-office ancillary services — the largest and most consequential exception, permitting group practices to furnish DHS in their own offices under detailed supervision, location, and billing requirements. It requires the group to satisfy the definition of a group practice at 42 C.F.R. § 411.352, which is itself demanding, particularly the rules on how profits from DHS may be distributed.

Physician recruitment, isolated transactions, fair market value compensation, indirect compensation arrangements, electronic health records items and services, and the 2021 value-based arrangement exceptions in three tiers keyed to the level of financial risk assumed.

The 2021 modernization also added a limited-remuneration exception (currently under $5,000 per year, indexed, with no writing or signature required), a cybersecurity technology donation exception, and clarified definitions of "fair market value," "commercially reasonable," and the volume-or-value standard — the last replaced with an objective test asking whether the formula includes referrals as a variable.

Fair market value in practice

Three arrangements out of four that fail Stark or the AKS fail on fair market value or documentation, not on structure. Practical points:

  • A valuation by a qualified appraiser is not conclusive but shifts the argument decisively. Obtain it before signing, not after a subpoena arrives.
  • Survey benchmarks are evidence, not a safe harbor. Paying at the 90th percentile for a physician whose credentials are median invites the question the government will ask.
  • Stacking is a recurring failure: a physician with an employment agreement, a medical directorship, a call coverage stipend, and a lease may be at fair market value on each and far above it in aggregate, and may be paid twice for the same hours. Inventory every payment stream to every referring physician.
  • Document the services. Time logs, meeting minutes, deliverables, reports. The opening example is not unusual — it is the single most common way a defensible arrangement becomes indefensible.
  • Calendar every term and renewal. An expired agreement under which payments continue is a compensation arrangement with no writing, and therefore no exception.

The False Claims Act

The False Claims Act, 31 U.S.C. §§ 3729–3733, is the enforcement engine. It imposes liability on anyone who knowingly presents a false or fraudulent claim for payment, knowingly makes or uses a false record or statement material to a false claim, or knowingly conceals or improperly avoids an obligation to pay money to the government — the reverse false claim.

Damages are three times the government's damages, plus a civil penalty per claim (indexed annually, currently in the range of roughly $14,000 to $28,000). In healthcare, where a single arrangement can taint hundreds of thousands of individual claims, the per-claim penalty frequently dwarfs the trebled damages and raises constitutional excessiveness questions that courts have addressed unevenly.

"Knowingly" means actual knowledge, deliberate ignorance, or reckless disregard. No specific intent to defraud is required.

Theories of falsity

Factual falsity — the service was not provided, or was provided by an unqualified person, or was billed under the wrong code (upcoding), or was not medically necessary.

Legal falsity by express certification — the provider expressly certified compliance with a condition of payment and the certification was false. Cost reports and enrollment forms contain such certifications.

Implied false certification — the subject of Universal Health Services, Inc. v. United States ex rel. Escobar, 579 U.S. 176 (2016). The Court held the theory viable where two conditions are met: the claim makes specific representations about the goods or services provided, and the failure to disclose noncompliance with a material requirement makes those representations misleading half-truths.

Escobar's more consequential holding is on materiality, which it called "demanding" and "rigorous." Materiality is not established merely because the government labeled compliance a condition of payment, or because it could have refused to pay. It is informed by whether the government consistently refuses to pay claims with that defect, and — importantly for defendants — evidence that the government paid claims with full knowledge of the noncompliance is "strong evidence" that the requirement is not material. Government-knowledge arguments are now a central defense, and they turn on discovery into what the agency knew and when.

Scienter after Schutte

In United States ex rel. Schutte v. SuperValu Inc., 598 U.S. 739 (2023), the Court resolved whether a defendant whose conduct was consistent with an objectively reasonable interpretation of an ambiguous requirement could be liable if it subjectively believed its claims were false. The Court held that it could: the FCA's scienter element turns on the defendant's actual knowledge, beliefs, or thoughts at the time, not on a post hoc objectively reasonable interpretation.

Practically, Schutte means contemporaneous internal communications decide these cases. An organization that identified a risk internally, decided the aggressive reading was probably wrong, and proceeded anyway is exposed regardless of how defensible the legal question looks in hindsight. Conversely, contemporaneous documentation of a good-faith interpretation — a legal opinion, a documented analysis, a request for guidance — is now the most valuable evidence a defendant can have. Generate it in real time or not at all.

Qui tam

31 U.S.C. § 3730(b) permits a private relator to sue in the government's name. The complaint is filed under seal, served on the government but not the defendant, and the government investigates — frequently for years — before deciding whether to intervene.

The relator's share is 15 to 25 percent if the government intervenes, 25 to 30 percent if it does not, plus fees and costs. That economics has produced a specialized plaintiffs' bar and made healthcare the largest source of FCA recoveries by a wide margin. Relator standing rests on a partial assignment of the government's claim. Vermont Agency of Natural Resources v. United States ex rel. Stevens, 120 S. Ct. 1858 (2000).

Limits on relators: the public disclosure bar, which precludes actions based on publicly disclosed allegations unless the relator is an original source; the first-to-file bar; and the government's authority to dismiss an action over the relator's objection under § 3730(c)(2)(A), which the Court confirmed in United States ex rel. Polansky v. Executive Health Resources, Inc., 599 U.S. 419 (2023), holding that the government may move to dismiss whenever it has intervened, with the district court applying Rule 41(a) standards on a deferential footing.

Limitations. Six years from the violation, or three years after the responsible government official knew or should have known the facts, but never more than ten years after the violation. In Cochise Consultancy, Inc. v. United States ex rel. Hunt, 139 S. Ct. 1507 (2019), the Court held the three-year tolling provision available in non-intervened cases and keyed to the government official's knowledge, not the relator's — so a relator may benefit from a limitations period measured by someone else's knowledge.

Retaliation. Section 3730(h) protects employees, contractors, and agents from retaliation for lawful acts in furtherance of an FCA action or efforts to stop a violation, with reinstatement, double back pay, and special damages. Most whistleblowers complain internally first; how the organization responds to that complaint frequently determines whether there is a qui tam case at all.

The 60-day overpayment rule

42 U.S.C. § 1320a-7k(d), added by the Affordable Care Act, requires that an identified overpayment be reported and returned within 60 days of the date it was identified, or the date any corresponding cost report is due, whichever is later. Retention beyond that window creates an obligation and therefore a reverse false claim.

The operative question is what "identified" means. CMS regulations provide that a person has identified an overpayment when the person has, or should have through reasonable diligence, determined that an overpayment was received and quantified it. CMS has described reasonable diligence as including timely, good-faith investigation, generally within six months of obtaining credible information, absent extraordinary circumstances — meaning the practical outer limit is roughly eight months from a credible indication to a returned payment.

The trap is that the clock does not wait for certainty. Credible information — a compliance hotline report, an internal audit finding, a payor's probe result — starts the diligence obligation. An organization that investigates slowly, or decides to "monitor" a known problem, converts a repayment obligation into an FCA case.

The lookback period for reporting and returning is six years.

The rest of the framework

Civil Monetary Penalties Law, 42 U.S.C. § 1320a-7a — penalties for false claims, for AKS violations, for employing an excluded person, and for beneficiary inducements: offering remuneration to a Medicare or Medicaid beneficiary likely to influence the selection of a provider. Waiving copayments routinely, or offering gift cards for appointments, implicates this provision, subject to exceptions for financial-need-based waivers, preventive care incentives, and "promotes access to care" remuneration of low value.

Exclusion, 42 U.S.C. § 1320a-7 — mandatory for conviction of program-related crimes, patient abuse, felony health care fraud, and felony controlled substance offenses; permissive for a longer list. An excluded person may not be employed or contracted with in any capacity by a provider billing federal programs, and payments to an entity employing one are themselves subject to penalties. Screen every employee, contractor, and vendor against the OIG List of Excluded Individuals/Entities and the System for Award Management, on hire and monthly.

Corporate integrity agreements — negotiated as part of a settlement in exchange for OIG's forbearance from exclusion, typically running five years and requiring a compliance officer and committee, board-level compliance certifications, individual management certifications, training, an independent review organization auditing claims and arrangements, disclosure obligations, and reportable event procedures. They are expensive and intrusive, and avoiding one is a legitimate settlement objective.

Criminal statutes beyond the AKS: 18 U.S.C. § 1347 (health care fraud), § 1035 (false statements relating to health care matters), § 669 (theft or embezzlement from a health care benefit program), the mail and wire fraud statutes, and money laundering charges that frequently accompany them. Note that § 1347 and § 669 apply to any health care benefit program, public or private.

State law. Most states have their own anti-kickback, self-referral, and false claims statutes, many of which extend to commercial payors, and many of which offer qui tam recovery of their own. A federal-only analysis is incomplete.

Building a program that works

The OIG's compliance program guidance — the general guidance updated in 2023 and the industry-specific segments that follow it — describes seven elements. What matters is which of them actually prevents the cases described above.

Inventory every financial relationship with a referral source. This is the single highest-value control, and most organizations cannot produce the inventory on demand. It should list, for every physician and physician-owned entity: every agreement, its term, its expiration, its compensation, its signature status, and its documentation of services. Reconcile the inventory to accounts payable — payments made outside any agreement are the classic finding.

Centralize approval. Every arrangement with a referral source should route through one function with authority to say no. Departmental autonomy in contracting is how organizations acquire arrangements nobody knew about.

Obtain independent valuation before signing for anything unusual, and document commercial reasonableness in plain language: why the organization needs these services, why this person, why this quantity.

Require and monitor deliverables. Time records, minutes, reports. Non-performance should suspend payment automatically.

Calendar terms. Automated expiration alerts at 120, 90, and 30 days.

Screen for exclusion monthly against LEIE and SAM, and document the results.

Run a real hotline and, crucially, respond to internal complaints promptly and without retaliation. Most qui tam relators tried internally first.

Audit claims for medical necessity and coding accuracy, and audit arrangements against the inventory.

Preserve the privilege deliberately. An internal investigation should be structured for privilege from the beginning — counsel-directed, with a documented legal purpose, Upjohn warnings to interviewees, and care about who receives the report — while recognizing that a decision to disclose may waive it.

Document good-faith interpretations contemporaneously. After Schutte, this is not a formality. It is the defense.

When something is found

Investigate promptly. The 60-day clock and the reasonable-diligence standard are running from the moment credible information exists.

Scope it. How many claims, over what period, at what value. Sampling and extrapolation are usually necessary; retain a statistician if the numbers are large.

Stop the conduct. Continuing a known violation converts a repayment problem into a knowing one.

Choose a disclosure path. There are three:

  • The OIG Self-Disclosure Protocol, for conduct implicating the AKS or involving false billing. It offers a presumption against a corporate integrity agreement, a lower multiplier than litigation (OIG's general practice has been a minimum multiplier of 1.5 times single damages), and a suspension of the 60-day clock during the process.
  • The CMS Voluntary Self-Referral Disclosure Protocol, for Stark-only violations, with settlement authority to compromise the amounts owed.
  • Simple refund through the payor or contractor, appropriate for coding and billing errors with no fraud dimension.

The choice matters and is not obvious: a Stark technical violation with no kickback dimension generally belongs in the CMS protocol, where the settlement history is far more favorable, while conduct implicating the AKS belongs with OIG. Disclosing to the wrong body wastes the benefit.

Weigh disclosure against the alternative honestly. Disclosure is not free — it is an admission, it is public in aggregate, and it costs money. But an undisclosed known overpayment retained past the deadline is a reverse false claim with treble damages, and the modern reality is that arrangements surface through relators, payor audits, and data analytics with considerable regularity.

Fix the underlying control, and document the fix. Whether the government is deciding on a CIA or a relator's counsel is evaluating a case, the difference between an organization that found and fixed a problem and one that did not is substantial.

A short case study

A multi-site orthopedic practice acquires an ambulatory surgery center and offers ownership units to its surgeons. It also enters into a management agreement with a local hospital and leases imaging equipment on a per-scan basis.

The ASC ownership is analyzed under the ASC safe harbor, which requires among other things that each physician investor derive at least one-third of medical practice income from performing procedures and perform at least one-third of procedures at that center. Two of the nine surgeons do not meet the thresholds. The arrangement does not fit the safe harbor — which is not automatically a violation, but requires an intent analysis and, more practically, a restructuring or a documented rationale.

The per-scan equipment lease fails both the AKS space-and-equipment safe harbor and the Stark equipment rental exception, because rent varies with use by a referral source. It is restructured to fixed monthly rent at appraised fair market value.

The hospital management agreement is documented with a scope of work, monthly deliverables, and time records, at a rate supported by a written valuation obtained before signing.

In-office ancillary services. The practice's imaging and physical therapy operations depend on the in-office ancillary services exception, which requires the practice to qualify as a group practice. Counsel reviews the profit-distribution methodology and finds that the practice distributes DHS profits based on each physician's DHS referrals — which the group practice definition prohibits. The methodology is changed to an overall-profits split, and the correction is documented.

The overpayment question. The per-scan lease means Stark was violated for eighteen months, and DHS claims referred during that period were not payable. The practice quantifies the claims, discloses through the CMS protocol, and settles for a fraction of the theoretical FCA exposure.

Total cost: substantial. Cost had a relator filed first: an order of magnitude higher, plus fees, plus a CIA.

Conclusion

The Anti-Kickback Statute asks why — and answers that if any purpose was to induce referrals, the arrangement is criminal regardless of fair pricing. The Stark Law asks whether the arrangement fits an exception — and answers that if it does not, liability follows without regard to intent. The False Claims Act asks what was billed — and multiplies the answer by three, then adds a penalty for every claim.

Three practical points carry most of the weight.

First, the failures are almost never structural. They are missing signatures, expired terms, undocumented services, per-click rent, and stacked compensation. A disciplined contract inventory would prevent most of the cases the government brings.

Second, after Schutte, contemporaneous documentation of good-faith reasoning is the defense in ambiguous cases, and it cannot be created after a subpoena. After Escobar, materiality and government knowledge are real defenses, and they are developed in discovery — which means preserving evidence of what the agency knew.

Third, the 60-day rule means that discovering a problem starts a clock. The organizations that get hurt are not usually the ones that made a mistake; they are the ones that found a mistake and moved slowly.

Related articles

This article is provided for general informational purposes and does not constitute legal advice. Fraud and abuse law is fact-specific, state analogues vary, and the safe harbors and exceptions summarized here contain requirements not fully described. Consult qualified healthcare regulatory counsel before entering into or continuing any arrangement with a referral source.