Several federal health care laws carry criminal penalties, but the ones most likely to result in prison time are HIPAA, the Anti-Kickback Statute, the federal health care fraud statute, the Controlled Substances Act, and the criminal False Claims Act. These aren’t just regulatory slaps on the wrist. Convictions under these laws carry sentences ranging from one year to life in prison, depending on the violation and its consequences.
HIPAA: Criminal Penalties for Misusing Patient Data
Most people know HIPAA as the privacy law that protects medical records. What’s less widely known is that it includes a criminal provision with three tiers of punishment based on how and why protected health information was misused.
The base offense, such as knowingly obtaining or disclosing someone’s health information without authorization, carries up to a $50,000 fine and one year in prison. If the violation involved false pretenses (for example, impersonating someone to access records), the maximum jumps to a $100,000 fine and five years. The harshest tier applies when someone steals health data for commercial advantage, personal gain, or to cause harm. That carries up to $250,000 in fines and 10 years in prison.
These criminal provisions are codified at 42 U.S.C. § 1320d-6, and they apply to anyone who knowingly violates the law, not just healthcare providers. Hospital employees, insurance workers, and even hackers can face prosecution.
The Anti-Kickback Statute
The Anti-Kickback Statute makes it a felony to offer, pay, solicit, or receive anything of value in exchange for referrals involving services paid for by federal health care programs like Medicare or Medicaid. This covers a wide range of arrangements: cash payments for patient referrals, lavish gifts to physicians in exchange for prescribing certain drugs, or sham consulting agreements designed to funnel money to referring providers.
Every violation is classified as a felony punishable by up to $100,000 in fines and 10 years in prison. The statute also applies to false statements about institutional conditions and illegal patient admittance practices, each carrying the same maximum penalties. Beyond prison time, a conviction triggers mandatory exclusion from all federal health care programs, which effectively ends a provider’s ability to treat Medicare or Medicaid patients.
Federal Health Care Fraud
The broadest criminal health care law is the federal health care fraud statute at 18 U.S.C. § 1347. It covers anyone who knowingly executes a scheme to defraud a health care benefit program or obtains money through false representations related to health care delivery or payment. This is the statute federal prosecutors use most often in large-scale billing fraud, phantom patient schemes, and medically unnecessary procedure cases.
The base penalty is up to 10 years in prison. If the fraud results in serious bodily injury to a patient, that ceiling doubles to 20 years. If someone dies as a result of the fraudulent scheme, the sentence can extend to life in prison. These enhanced penalties make health care fraud one of the most severely punished white-collar crimes in federal law.
Recent enforcement actions illustrate how aggressively these cases are prosecuted. In one national takedown, the Department of Justice charged 324 defendants in connection with over $14.6 billion in alleged fraud. Individual sentences in similar cases have included seven years for a telemedicine company owner and over eight years for an orthopedic surgeon involved in a $145 million scheme.
The Controlled Substances Act
Physicians and other prescribers face criminal liability under the Controlled Substances Act when they prescribe medications outside the bounds of legitimate medical practice. The key legal question is whether the provider knowingly wrote prescriptions without a legitimate medical purpose.
The U.S. Supreme Court clarified this standard in its 2022 decision in Ruan v. United States, ruling that prosecutors must prove beyond a reasonable doubt that a physician knowingly intended to prescribe outside their authority. A simple mistake or difference in medical judgment isn’t enough. But when the evidence shows a provider was essentially operating as a drug dealer with a medical license, sentences are severe. The two physicians in the Ruan case received sentences of 21 and 25 years, respectively.
Felony convictions related to unlawful prescribing or distribution of controlled substances also trigger mandatory exclusion from Medicare, Medicaid, and all other federal health care programs.
The Criminal False Claims Act
The False Claims Act is often discussed as a civil law, and most cases under it are civil. But there is a parallel criminal version at 18 U.S.C. § 287. It applies to anyone who knowingly submits a false, fictitious, or fraudulent claim to the federal government. In health care, this typically means billing Medicare or Medicaid for services that were never provided, upcoding procedures to get higher reimbursement, or misrepresenting the nature of services delivered.
The criminal version carries up to five years in prison per violation. The critical element that separates criminal from civil liability is intent: the government must prove the person knew the claim was false when they submitted it. Physicians have gone to prison under this provision, according to the HHS Office of Inspector General.
How Criminal Intent Is Established
All of these laws require some level of criminal intent, though the bar varies. The general standard across most federal health care criminal statutes is “knowingly and willfully,” meaning the person was aware their conduct was unlawful and chose to do it anyway. You don’t need to know the specific statute you’re violating, but you do need to know your actions are wrong.
For the Anti-Kickback Statute, Congress has specified that the government doesn’t need to prove a defendant had specific knowledge of the statute or intent to violate it. For Controlled Substances Act prosecutions of physicians, the Supreme Court set a higher bar, requiring proof that the doctor knew they were prescribing outside any legitimate medical purpose.
Mandatory Exclusion From Federal Programs
Criminal conviction under any of these laws carries a consequence that can be just as devastating as prison: mandatory exclusion from federal health care programs. The HHS Office of Inspector General is required by law to exclude anyone convicted of Medicare or Medicaid fraud, patient abuse or neglect, felony health care fraud or financial misconduct, or felony controlled substance offenses.
Exclusion means you cannot bill Medicare, Medicaid, CHIP, or any other federal health program. For most health care providers, this is a career-ending sanction that persists long after a prison sentence is served. Even after exclusion periods end, reinstatement is not automatic and requires a formal application process.
The Stark Law Is Different
One law that often comes up in this discussion is the Stark Law, which prohibits physicians from referring patients to entities where they have a financial relationship for certain designated health services. Despite its importance, the Stark Law itself is a civil statute. It does not directly carry criminal penalties. However, violations of the Stark Law frequently overlap with the Anti-Kickback Statute or the False Claims Act, and those companion violations can absolutely lead to criminal prosecution. So while you won’t be charged criminally under the Stark Law alone, the conduct it prohibits often crosses into territory covered by laws that do carry prison time.