The penalty for falsifying medical records can include up to 20 years in federal prison, civil fines reaching into the millions, loss of a medical license, exclusion from Medicare and Medicaid, and personal civil liability to any patient harmed. These consequences are stacked, not alternative: criminal prosecutors, civil plaintiffs, state licensing boards, and federal oversight agencies each move independently, and a single altered chart can trigger all of them at once.
Federal Prison Time
Three federal statutes do most of the work in these prosecutions, and prosecutors pick among them based on what the falsification was for.
The most direct one is 18 U.S.C. § 1035, which makes it a crime to falsify or conceal a material fact, or to make a materially false statement or document, in connection with healthcare benefits, items, or services. A conviction carries up to five years in prison, a fine, or both.1Office of the Law Revision Counsel. 18 U.S. Code 1035 – False Statements Relating to Health Care Matters
When falsified records are part of a broader scheme to defraud a healthcare program, the charge shifts to 18 U.S.C. § 1347. The base penalty is up to 10 years. If the fraud results in serious bodily injury, the maximum doubles to 20 years. If someone dies as a result, the sentence can reach life.
The heaviest statute is 18 U.S.C. § 1519, which punishes anyone who alters or falsifies records to obstruct a federal investigation or proceeding. It is not limited to healthcare; it applies whenever falsified documents impede any federal matter. The maximum is 20 years.2Office of the Law Revision Counsel. 18 USC 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations and Bankruptcy
All three require proof that the falsification was knowing and intentional. Sloppy handwriting, honest mistakes, or accidental omissions do not meet the standard. Prosecutors typically build the case with digital audit trails, forensic analysis of the records, and testimony from staff who saw the changes happen.
HIPAA Criminal Penalties
HIPAA’s criminal provision, 42 U.S.C. § 1320d-6, applies when someone wrongfully obtains or discloses individually identifiable health information. It can reach falsification when the fabricated records are part of a scheme involving protected health information. The penalties are tiered:3Office of the Law Revision Counsel. 42 U.S. Code 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information
- Base violation: up to one year in prison and a $50,000 fine.
- Under false pretenses: up to five years and a $100,000 fine.
- For commercial advantage, personal gain, or malicious harm: up to ten years and a $250,000 fine.
Most falsification cases that touch HIPAA land in the second or third tier. Altering records to cover up billing fraud, or to protect yourself from the fallout of a medical error, pushes the case into felony territory.
HIPAA Civil Fines
Separate from criminal charges, the Department of Health and Human Services can impose civil monetary penalties. The amounts are inflation-adjusted each year, and the 2026 figures are:4Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
- No knowledge of the violation: $145 to $73,011 per violation, up to $2,190,294 per year.
- Reasonable cause, not willful neglect: $1,461 to $73,011 per violation, up to $2,190,294 per year.
- Willful neglect, corrected within 30 days: $14,602 to $73,011 per violation, up to $2,190,294 per year.
- Willful neglect, not corrected: $73,011 to $2,190,294 per violation, up to $2,190,294 per year.
Deliberate falsification almost always lands in the willful neglect tiers. And because each altered record can count as its own violation, a provider who tampered with charts across dozens of patients can see HIPAA fines alone reach the millions.
False Claims Act Liability
When falsified records support fraudulent billing to Medicare, Medicaid, or any other federal healthcare program, the False Claims Act brings some of the steepest financial penalties in federal law. Anyone who knowingly submits a false claim, or uses a false record material to a false claim, is liable for three times the government’s actual damages plus a per-claim civil penalty.5Office of the Law Revision Counsel. 31 USC 3729 – False Claims
The statutory per-claim penalty is $5,000 to $10,000, adjusted upward annually for inflation. The treble damages piece is often where the exposure explodes: a provider who billed $200,000 off falsified records owes $600,000 in damages before any per-claim penalty is added.
The False Claims Act also carries a whistleblower mechanism that reaches directly into the practice. Any employee can file a qui tam lawsuit on the government’s behalf. If the government intervenes and the case succeeds, the whistleblower receives 15% to 25% of the recovery; if the government declines and the whistleblower pursues it alone, the share rises to 25% to 30%.6Office of the Law Revision Counsel. 31 U.S. Code 3730 – Civil Actions for False Claims Federal law also prohibits retaliation against employees who report fraud. The people most likely to see falsified records, the ones who work with them every day, have both a financial reason and legal protection to come forward.
Civil Lawsuits by Patients
Patients harmed by falsified records can sue for medical malpractice or fraud. They have to show the provider owed a duty of care, breached it by falsifying records, and caused actual harm, whether through misdiagnosis, delayed treatment, or an unnecessary procedure. Compensatory damages cover medical bills, lost income, and the cost of corrective treatment. Punitive damages are available when the conduct is especially egregious, and the amounts vary with the severity of harm and the jurisdiction.
What the Cover-Up Costs in Court
This is where falsifying records tends to backfire hardest. When a court finds that a party altered or destroyed medical records, it can impose spoliation sanctions. The most common is an adverse inference instruction, which tells the jury it may assume the altered records would have been unfavorable to the party that tampered with them. Courts apply this where “the evidence must support a finding of intentional loss or destruction of evidence in order to prevent its use in litigation.”
Judges can go further: bar the offending party from introducing any alternative version of the records, strike their defenses, impose attorney’s fees, or in extreme cases enter default judgment. The cover-up often does more legal damage than the underlying error ever would have.
License Discipline
State medical boards act independently of criminal prosecutors and do not need a conviction to move. They investigate on patient complaints, hospital reports, or referrals, and their tools include suspension, revocation, probation, reprimand, and fines.7FSMB. About Physician Discipline Administrative fines for record-keeping violations typically run $1,000 to $10,000, with wide variation by state and severity.
When a board takes adverse action, including a voluntary surrender, it must report it to the National Practitioner Data Bank within 30 days along with a description of the conduct that triggered it.8NPDB. What You Must Report to the NPDB NPDB records follow a provider indefinitely. Hospitals, insurers, and licensing boards in other states query the database before granting privileges or licenses, so a report tied to falsifying charts makes it very difficult to practice anywhere.
Malpractice Insurance Will Not Pay
Most medical malpractice policies exclude coverage for intentional wrongful acts, fraud, and criminal conduct. Falsifying records almost always qualifies as intentional, so the insurer can refuse to pay any judgment or settlement arising from it. Some policies cover defense costs up to a limit even for excluded claims, but the provider personally absorbs the damages. In some states, the insurer only has to show the provider intended the act; in others, the provider must have intended the resulting harm. Either way, deliberately altering a chart is hard to characterize as anything else.
Exclusion From Medicare and Medicaid
The HHS Office of Inspector General can exclude individuals and entities from Medicare, Medicaid, TRICARE, and every other federally funded healthcare program. Once excluded, no federal program will pay for any item or service the provider furnishes, orders, or prescribes, and any organization that knowingly employs an excluded person faces civil monetary penalties of its own.9U.S. Department of Health and Human Services Office of Inspector General. Exclusions
Exclusion is mandatory, with no OIG discretion, after convictions for Medicare or Medicaid fraud, patient abuse or neglect, felony healthcare fraud, or felony controlled substance offenses. The minimum period in each category is five years.10U.S. Department of Health and Human Services Office of Inspector General. Exclusions Authorities OIG also has permissive exclusion authority for conduct that shows untrustworthiness even without a criminal conviction. Since federal programs account for most of the revenue in a typical practice, exclusion often ends it.
Where the Legal Line Sits
Correcting a record is not falsifying one, and the difference is procedural. Under 45 C.F.R. § 164.526, patients can request amendments to their records, and a covered entity must act within 60 days, with one 30-day extension available if the provider explains the delay in writing.11eCFR. 45 CFR 164.526 – Amendment of Protected Health Information The original entry stays intact; the correction is appended or linked so both versions are visible. If the provider denies the request, the patient can file a statement of disagreement, which is attached to the record.
Provider-initiated corrections follow the same rule: original stays, labeled addendum with the date and reason is added. What crosses into falsification is deleting, overwriting, or backdating entries so the chart appears to say something it never did. Electronic health record systems keep audit logs of every change, which makes this kind of tampering increasingly easy to prove.
How Long Prosecutors and Plaintiffs Have
Federal criminal charges under 18 U.S.C. §§ 1035, 1347, and 1519 generally carry a five-year statute of limitations.
State civil malpractice claims tied to falsified records follow state deadlines that range from one to five years, with two years most common. Many states apply a discovery rule that starts the clock when the patient knew or should have known about the falsification, which matters because altered records are built to stay hidden. Some states cap the outer deadline with a statute of repose running three to ten years from the date of treatment.
False Claims Act qui tam actions run six years from the violation, or three years after the government knew or should have known about the fraud, whichever is later, but never more than ten years from the violation. Because falsified billing records often go undetected for years, those extended deadlines give whistleblowers real time to act.