How Can a Health Care Worker Commit a Criminal Offense?

A healthcare worker commits a criminal offense when their conduct moves past a professional mistake into intentional wrongdoing, recklessness, or fraud. That line separates a malpractice claim, which a patient brings for compensation, from a criminal case, which the government brings and which can end in prison, heavy fines, and permanent exclusion from the profession. The conduct that crosses it tends to fall into a handful of recognizable categories: harming a patient, stealing or diverting drugs, defrauding federal insurance programs, taking kickbacks, snooping in medical records, practicing without a valid license, falsifying charts, and ignoring a legal duty to report abuse.

Harming a Patient

Directly injuring someone in your care is the clearest route to criminal charges. Physical assault, sexual abuse during an exam, and any unwanted physical contact all qualify. Performing a medical procedure on a patient who never agreed to it is battery under the law, even if the procedure was medically appropriate, and forcing treatment on an unwilling patient carries the same legal weight as any other unauthorized physical contact.¹

Severe neglect can also be criminal, though prosecutors generally reserve those cases for conduct that shows callous disregard for the duty to care. A simple mistake, even one with serious consequences, is not enough. The worker must have been aware of the risk and ignored it anyway. When that kind of recklessness leads to a patient’s death, prosecutors can bring involuntary manslaughter or criminally negligent homicide charges. This is where the fight between malpractice and crime gets argued most aggressively, and it usually turns on how obviously dangerous the worker’s behavior was.

Abuse of vulnerable adults in nursing homes and long-term care is its own category. Every state criminalizes abuse, neglect, and exploitation of elderly and disabled individuals, and Medicaid Fraud Control Units in all 50 states, the District of Columbia, and U.S. territories have authority to investigate abuse and neglect of residents in healthcare and care settings.² Stealing a patient’s property, coercing someone to change a will, and financial exploitation of elderly or incapacitated patients carry their own criminal penalties on top of any abuse charges.

Fraud and Kickbacks

Financial crimes produce the largest sentences in healthcare. The federal Anti-Kickback Statute makes it a felony to pay or receive anything of value in exchange for patient referrals involving services covered by Medicare, Medicaid, or other federal healthcare programs. “Anything of value” is read broadly: cash, free office rent, expensive meals, and inflated consulting fees all count. A conviction carries fines up to $100,000 and up to 10 years in prison.³

Billing fraud is the other pillar. Common schemes include billing for services never provided, billing for a more expensive procedure than the one actually performed, and unbundling services that should be billed together to inflate the total. Criminal prosecution typically proceeds under federal healthcare fraud statutes, and civil consequences layer on top. The False Claims Act lets the government recover three times its actual losses plus an additional per-claim penalty that is adjusted for inflation each year.⁴ A single scheme often triggers criminal prosecution and civil recovery at the same time. The Department of Justice has flagged medical necessity fraud, drug pricing manipulation, and managed care fraud as current enforcement priorities.

Drug Diversion

Diversion means redirecting prescription medication away from its intended use. A nurse who pockets opioids from a dispensing cabinet, a pharmacist who writes fraudulent prescriptions, or a technician who replaces a controlled substance with saline and keeps the original is committing a federal crime under the Controlled Substances Act.⁵

The usual methods include stealing medications outright from pharmacy stock or automated dispensing machines, documenting that a dose was given to a patient while keeping it, creating prescriptions for nonexistent patients, and tampering with medication waste to recover usable drugs. Each of these harms patients directly. A patient whose pain medication was replaced with saline suffers needlessly. A patient injected with a used, refilled syringe faces infection risk.

Healthcare facilities must notify the DEA in writing within one business day of discovering any theft or significant loss of controlled substances, and they must file a completed DEA Form 106 within 45 days.⁶ The DEA weighs the significance of a loss by the quantity missing, the type of substance, whether the loss can be traced to specific individuals, and whether a pattern exists. A worker caught diverting faces federal prosecution, loss of license, and permanent exclusion from the field.

Practicing Without a License and Falsifying Records

Practicing medicine, nursing, or any licensed health profession without a valid license is a crime in every state. That covers working after a license has been revoked or suspended, performing procedures outside your scope of practice, and misrepresenting your credentials. The charge can be a misdemeanor or felony depending on the circumstances, with penalties rising sharply when a patient is harmed.

Falsifying medical records is a separate crime that often rides along with other offenses. A worker who administers the wrong medication and alters the chart to cover it up has committed two distinct violations. Record falsification also obstructs legal proceedings when those records turn up as evidence in malpractice suits, criminal investigations, or insurance audits. The charge can stand alone even if no patient was harmed by whatever the worker was trying to hide.

Criminal HIPAA Violations

Most HIPAA breaches end in civil penalties handled by the Department of Health and Human Services. But when a healthcare worker knowingly accesses or shares a patient’s protected health information without authorization, the Department of Justice can bring criminal charges. The penalties scale with intent:

Knowingly obtaining or disclosing protected health information: fine up to $50,000 and up to one year in prison.
Obtaining the information through false pretenses: up to $100,000 and five years.
Obtaining or disclosing the information for personal gain, commercial advantage, or malicious harm: up to $250,000 and 10 years.

The key word is “knowingly.” An accidental email to the wrong recipient is a civil matter. Pulling up a celebrity patient’s chart out of curiosity, selling patient data, or looking through an ex-spouse’s records crosses into criminal territory.⁷

Failing to Report Abuse

Healthcare workers in every state are mandatory reporters. They have a legal duty to report suspected abuse or neglect of children, elderly individuals, and other vulnerable people to the appropriate authorities. Specifics vary by state, but the obligation is universal across healthcare settings. Failing to report is itself a criminal offense in most states and can create civil liability as well. A worker who sees a colleague abusing a patient and stays quiet is not just violating workplace policy. They may be committing a crime.

The reporting threshold is low. The worker does not need to be certain abuse occurred; a reasonable suspicion is enough to trigger the duty. Assuming someone else will file the report, or deciding the incident was not serious enough, does not satisfy the law.

What a Conviction Costs Beyond Prison

A criminal conviction brings consequences that outlast any sentence. The Office of Inspector General can permanently exclude a convicted healthcare worker from Medicare, Medicaid, and all other federal healthcare programs. Once excluded, no federal program will pay for any item or service that worker provides or orders.⁸

The practical effect is severe. Any employer that receives federal healthcare reimbursement, which includes nearly every hospital, clinic, and pharmacy, generally cannot hire an excluded individual in any capacity. An employer who knowingly or negligently hires an excluded worker faces penalties of up to $10,000 for each item or service that worker provides, plus triple the amount billed to the federal program.⁸ A narrow exception allows employment only if the worker is paid entirely from non-federal funds and serves only non-federal patients.

Who Investigates These Cases

Healthcare crimes are worked by a network of federal and state agencies. The HHS Office of Inspector General oversees program compliance and can impose civil monetary penalties. The DEA handles controlled substance violations. The FBI takes on large-scale fraud. At the state level, Medicaid Fraud Control Units sit inside the state attorney general’s office in every state and employ their own investigators, attorneys, and auditors.²

Investigations often start with tips from coworkers, patients, or billing auditors who spot patterns. Many fraud cases begin as qui tam lawsuits, where a whistleblower files under the False Claims Act and the government decides whether to intervene. A worker under investigation commonly faces parallel proceedings: a criminal case, a civil recovery action, a professional licensing review, and possible OIG exclusion, all moving at once.⁹

1
Public Health Law Map. Battery – No Consent
2
Office of Inspector General. Medicaid Fraud Control Units
3
Justia Law. 42 US Code 1320a-7b – Criminal Penalties for Acts Involving Federal Health Care Programs
4
Office of the Law Revision Counsel. 31 US Code 3729 – False Claims
5
Office of the Law Revision Counsel. 21 US Code 841 – Prohibited Acts A
6
eCFR. 21 CFR 1301.76 – Other Security Controls for Non-Practitioners; Narcotic Treatment Programs and Compounders for Narcotic Treatment Programs
7
Office of the Law Revision Counsel. 42 US Code 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information
8
U.S. Department of Health and Human Services Office of Inspector General. The Effect of Exclusion From Participation in Federal Health Care Programs
9
Department of Justice. The False Claims Act