The most common charges against healthcare workers are healthcare fraud, drug diversion, HIPAA violations, patient abuse, and medical malpractice. They sort into three tracks that often run at once: federal or state criminal prosecution, civil lawsuits for money damages, and licensing board actions that can end a career. The scale is not small. In a single 2025 federal enforcement sweep, 324 defendants were charged in healthcare fraud schemes involving more than $14.6 billion in fraudulent billing.1U.S. Department of Health and Human Services Office of Inspector General. 2025 National Health Care Fraud Takedown
Healthcare Fraud Is the Most Common Federal Charge
Healthcare fraud is the single most common federal criminal charge against people working in the industry. It covers any deliberate scheme to cheat a health insurance program, public or private, out of money. The typical patterns are billing for services never provided, upcoding a visit to justify a higher payment, and performing unnecessary procedures to generate revenue.
Federal healthcare fraud carries up to 10 years in prison. If a patient suffers serious bodily injury because of the scheme, the ceiling rises to 20 years. If someone dies, the sentence can be life.2Office of the Law Revision Counsel. 18 USC 1347 – Health Care Fraud Criminal fines reach $250,000 for an individual defendant.3Centers for Medicare & Medicaid Services. Laws Against Health Care Fraud
Kickbacks and Self-Referrals
Two federal laws target the financial relationships that can corrupt medical decision-making. The Anti-Kickback Statute makes it a felony to pay or accept anything of value in exchange for referring patients to services covered by Medicare, Medicaid, or other federal health programs. Cash counts, so do expensive gifts, and so do below-market office leases structured to reward referrals. Conviction carries up to $100,000 in fines, up to 10 years in prison, or both.4Office of the Law Revision Counsel. 42 USC 1320a-7b – Criminal Penalties for Acts Involving Federal Health Care Programs Prosecutors do not need to show patient harm. The payment itself is the crime.
The Stark Law is civil rather than criminal. It bars physicians from referring patients for certain designated health services to entities where the physician or an immediate family member has a financial interest. A doctor who owns a stake in an imaging center and sends patients there for MRIs is in Stark territory unless a specific exception applies. Penalties include fines of up to $15,000 per improper claim, repayment of three times what was collected, and possible exclusion from Medicare and Medicaid.5Office of the Law Revision Counsel. 42 US Code 1395nn – Limitation on Certain Physician Referrals
The False Claims Act and Whistleblowers
Many fraud cases are pursued civilly under the False Claims Act. Anyone who knowingly submits a false claim to a federal program faces three times the government’s losses plus a per-claim civil penalty.6Office of the Law Revision Counsel. 31 USC 3729 – False Claims As of the most recent 2025 inflation adjustment, that per-claim penalty runs from $14,308 to $28,619. Those numbers add up fast when a billing scheme covers hundreds or thousands of claims.
What makes the Act especially dangerous is its whistleblower provision. Any person with knowledge of the fraud can sue on the government’s behalf. If the government joins the case, the whistleblower receives 15% to 25% of the recovery. If the government declines and the whistleblower pursues it alone, the share rises to 25% to 30%.7Office of the Law Revision Counsel. 31 US Code 3730 – Civil Actions for False Claims Co-workers, billing staff, and former employees are the usual sources, which is why billing schemes rarely stay hidden.
Drug Diversion and Prescription Fraud
Healthcare workers have access to controlled substances most people do not, and that access creates its own criminal category. Drug diversion covers stealing medications from a hospital or clinic, swapping a patient’s painkillers with a weaker substitute, or pocketing drugs left over from procedures. Prescription fraud includes writing prescriptions without a legitimate medical purpose, forging another provider’s name, or using deception to obtain controlled substances.
Federal law prohibits distributing or possessing controlled substances with intent to distribute, with penalties that scale sharply by drug type and quantity. Large quantities of opioids or fentanyl can trigger mandatory minimums of 10 years to life.8Office of the Law Revision Counsel. 21 US Code 841 – Prohibited Acts A A healthcare worker who obtains controlled substances through fraud, forgery, or misrepresentation faces up to four years in prison for a first offense and up to eight for a subsequent conviction.9Office of the Law Revision Counsel. 21 USC 843 – Prohibited Acts C Even small-scale diversion by one nurse or pharmacist usually triggers both criminal prosecution and an immediate licensing investigation.
HIPAA Violations
HIPAA created both civil and criminal penalties for mishandling patient health information, and this is where many healthcare workers underestimate their exposure. A HIPAA violation does not require malicious intent.
Civil Penalties
Civil penalties sit in four tiers based on the violator’s level of awareness. The statute runs from $100 per violation at the lowest tier, where the person did not know about the violation, up to $50,000 per violation for willful neglect that goes uncorrected, with annual caps reaching $1.5 million per violation category.10GovInfo. 42 USC 1320d-5 – General Penalty for Failure to Comply with Requirements and Standards After annual inflation adjustments, the minimum penalty per violation is now $145 and the top-tier annual cap exceeds $2.1 million. The HHS Office for Civil Rights enforces these penalties and has grown more aggressive about pursuing inadvertent disclosures.
Criminal Penalties
A healthcare worker who knowingly obtains or discloses protected health information without authorization faces criminal prosecution. The penalties escalate with intent. A basic knowing violation carries up to $50,000 in fines and one year in prison. Obtaining health information under false pretenses raises that to $100,000 and five years. Acting with intent to sell, transfer, or use the information for personal gain or to cause harm can bring $250,000 in fines and 10 years in prison.11Office of the Law Revision Counsel. 42 US Code 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information
Snooping through a celebrity’s chart or sharing a co-worker’s health information out of curiosity can trigger the criminal provisions. These cases are not hypothetical. They happen regularly in facilities where access controls are lax.
Patient Abuse and Neglect
Physical abuse, sexual abuse, and severe neglect are prosecuted under state criminal statutes. These charges arise most often in nursing homes and long-term care facilities, where patients may be unable to report mistreatment themselves. Every state and the District of Columbia have laws protecting older adults from physical abuse, neglect, financial exploitation, and sexual abuse, though definitions and penalties vary.12United States Department of Justice. State Elder Abuse Statutes Related charges include assault or battery for non-consensual touching or improper use of restraints, theft of patient belongings, and financial exploitation of cognitively impaired patients.
Medical Malpractice and Related Civil Claims
Medical malpractice is the most common civil claim against healthcare workers. It alleges that a provider’s care fell below the accepted professional standard and that the shortfall caused an injury. The frequent allegations are misdiagnosis or delayed diagnosis, medication errors, surgical mistakes, and failure to monitor a patient’s condition.
Filing deadlines vary by state, generally running from one to seven years. Most states apply a “discovery rule” that starts the clock when the patient discovers (or reasonably should have discovered) the injury rather than when the error occurred. Many states also impose a statute of repose, an absolute cutoff beyond which claims are barred regardless of discovery. Several states cap non-economic damages such as pain and suffering, with ceilings typically ranging from a few hundred thousand dollars to over a million depending on the state and the injury.
Two related civil claims deserve a mention. A healthcare worker who performs a procedure without valid consent can face a civil battery claim; the issue is not that the procedure was done poorly but that the patient never agreed to be touched that way. Treatment that differs substantially from what the patient consented to also qualifies.13National Center for Biotechnology Information. The Parameters of Informed Consent When negligence causes a patient’s death, surviving family members can bring a wrongful death lawsuit covering medical expenses, funeral costs, lost financial support, and emotional loss. These claims follow the same general principles as malpractice but often produce larger awards.
Licensing Board Actions Run on Their Own Track
Criminal charges and civil lawsuits are not the end of the exposure. Every state has a licensing board for each category of healthcare professional, and those boards have broad authority to investigate and discipline. They act on complaints involving incompetent practice, substance abuse, criminal convictions, sexual misconduct, and failure to meet the standard of care.14Federation of State Medical Boards. About Physician Discipline
Possible discipline includes license revocation or suspension, probation with monitoring and conditions like supervised practice or random drug testing, formal reprimand that becomes part of the permanent record, and fines or mandatory education.14Federation of State Medical Boards. About Physician Discipline
A board investigation can proceed at the same time as a criminal case and does not have to wait for it to conclude. The standard of proof is also lower. Boards use a preponderance-of-evidence standard, not the beyond-a-reasonable-doubt standard required for criminal conviction. A healthcare worker acquitted of criminal charges can still lose a license over the same conduct.
Why Resolution Isn’t the End: Exclusion and the NPDB
Two federal mechanisms make any serious charge or disciplinary action follow a healthcare worker for the rest of a career.
The HHS Office of Inspector General maintains a list of individuals and entities excluded from Medicare, Medicaid, and all other federal healthcare programs. An excluded worker cannot provide services that any federal program reimburses, even indirectly. Exclusion is mandatory after conviction for a crime related to the delivery of a service under a federal healthcare program, patient abuse or neglect, felony healthcare fraud, or a felony involving controlled substances, with a minimum five-year term.15Office of the Law Revision Counsel. 42 US Code 1320a-7 – Exclusion of Certain Individuals and Entities From Participation in Medicare and State Health Care Programs For most healthcare workers, exclusion is a career-ending event. Nearly every hospital, clinic, and pharmacy receives some federal reimbursement, and employers are required to screen hires and contractors against the list.
The National Practitioner Data Bank is a federal repository tracking malpractice payments, licensing actions, clinical privilege restrictions, healthcare-related criminal convictions, and federal exclusions. Reports must be submitted within 30 days of the triggering event.16eCFR. 45 CFR Part 60 – National Practitioner Data Bank Hospitals are required to query the NPDB when granting or renewing clinical privileges, and many other healthcare employers check it too.17National Practitioner Data Bank. What You Must Report to the NPDB NPDB records do not expire. A malpractice payment from 20 years ago still appears when a hospital runs a query, which is why experienced healthcare attorneys often weigh NPDB impact before advising a client to accept any settlement or consent order.