A letter from MDHHS-OIG, a subpoena, a Civil Investigative Demand, or agents at the front desk are not the beginning of an investigation. They are the moment an investigation that has been running for months becomes visible to you.What you produce in the next two weeks will shape whether this stays an administrative matter or becomes a criminal one.

Provider investigations do not start with the letter. They start with a data analytics flag, a payer referral, or a former employee's complaint — and then they run quietly through claims data, prescribing patterns, and interviews with people who used to work for you. The first document you receive is the point at which the government has already decided it has something worth pursuing.
That asymmetry is the reason competent, well-meaning providers get hurt. They respond fast, cooperatively, and thoroughly — producing thousands of pages, letting the billing manager explain coding decisions off the cuff, cleaning up a chart or two along the way — and in doing so they hand over a case that was not fully assembled. Cooperation is often the right strategy. Unadvised cooperation almost never is.
The question in the first week is not whether to cooperate. It is what, precisely, you are required to produce, in what form, by when, and what you are not.
If any of these have happened — call before you produce anything.
Almost none of these begin as a scheme. They begin as a template, a supervision arrangement, a marketing agreement, or a coding habit that nobody revisited — and then a retrospective review reads intent into the pattern.
Levels of service or code combinations the payer says the documentation doesn't support.
Often a documentation, template, or scheduling-record problem before it is anything else.
A retrospective second-guess of clinical judgment, argued through a chart review.
Anti-Kickback Statute and Stark exposure in leases, medical directorships, and marketing deals.
Incident-to billing, mid-level supervision, locum arrangements, and enrollment questions.
Timesheets, mileage logs, plans of care, and eligibility certifications.
Refill patterns, dispensing records, prescriber documentation, and product substitution.
Civil liability with treble damages and per-claim penalties, often driven by a sealed whistleblower case.
Volume production is not cooperation. It is the government's exhibit list, assembled by you, without privilege review or a narrowing negotiation.
Agents want the biller's imprecise explanation of how coding decisions were made. That sentence becomes the intent evidence.
Correcting a chart after you learn of an investigation is how a billing dispute becomes an obstruction allegation.
An unadvised refund can be characterized as an admission that the claims were false and that you knew it.
Any outreach risks witness tampering and retaliation claims, and it will be documented.
Consultant work product is generally not privileged. Everything they write is discoverable. The same analysis run through counsel often is protected.
Referrals from auditors to OIG and the Attorney General are routine, and the audit file travels with the referral.
The government has had months. Your deadline is measured in days. Those are not the same clock.
Providers under audit reasonably reach for a billing consultant or coding auditor first. The instinct is right; the sequencing usually isn't. A consultant retained directly by the practice generally produces unprotected work product: the memo identifying your worst fifty claims is discoverable, and it can end up establishing that you knew.
The same coding expert, engaged through counsel as part of a privileged internal review, typically produces protected analysis. You still get the honest assessment you need — you just get it without writing the government's brief. That single decision, made in week one, changes what the file looks like a year later.
Opens provider audits, overpayment reviews, prepayment review, and payment suspensions.
The state's Medicaid Fraud Control Unit; brings state criminal charges against providers.
HHS-OIG, the FBI, and the U.S. Attorney's Office when the matter involves federal program dollars or a False Claims Act theory.
Andrew Kassab Law is not affiliated with MDHHS, the Michigan Attorney General's office, HHS-OIG, or any federal agency. These agencies are named for informational purposes so you can identify the source of the contact you've received.
Charging decisions in these cases are made by people weighing provable intent against effort. Having sat on that side of the table, Andrew evaluates a provider file the same way — what a prosecutor can actually prove, what they will not want to try, and where the case is most likely to end short of a courtroom.
What arrived, from whom, on what date, and what has already been said or produced.
Litigation hold, a single point of contact, staff instructions, and no further unadvised communication with the payer or agents.
Privileged coding and documentation analysis so we understand the actual claims data before the government explains it to us.
Narrow the demand, extend deadlines where possible, and open a controlled channel with the agency or prosecutor.
Administrative resolution, civil settlement, declination, or defense at trial — structured around licensure and exclusion consequences, not just the criminal count.
No — but one can become the other. An audit or overpayment review is administrative on its face, and many resolve that way. The problem is that everything you produce in an audit can later be used in a criminal case, and referrals from auditors to MDHHS-OIG or the Attorney General's Health Care Fraud Division are routine. Treat the audit as if a prosecutor may eventually read the file, because sometimes one does.
Not before counsel has spoken with them. Agents often approach billing staff, medical assistants, and former employees at home, in the evening, without warning. Your staff are usually trying to be helpful, and helpful, imprecise answers about how billing worked become the government's evidence on intent. Employees have the right to decline an interview or to have counsel present, and they should know that before the knock, not after.
A CID is a compulsory pre-suit discovery tool used in False Claims Act investigations. It can demand documents, written answers, and sworn testimony. It signals that the government is evaluating a civil fraud theory, sometimes alongside a parallel criminal inquiry, and sometimes because a whistleblower filed a sealed qui tam complaint. It has real deadlines and should never be answered without counsel.
A payment suspension based on a credible allegation of fraud can shut off cash flow long before anyone proves anything. For many practices that is the existential event, not the eventual charge. There are procedural avenues to contest a suspension and to seek a good-cause exception, but they are time-sensitive. This is one of the situations where hours genuinely matter.
Sometimes an overpayment is resolved with repayment — and sometimes an unadvised repayment is treated as an admission that fixes the government's intent problem for them. Whether repayment helps or hurts depends on the posture of the case and how it is documented. Do not write the check, and do not send the corrected claims, before you know which situation you are in.
Especially then. Most provider cases we see are not schemes. They are documentation gaps, an upcoding pattern created by a template, a credentialing or supervision issue, or a biller who cloned a code. Those facts have to be explained precisely and early, in the government's language, with records that support them. Innocence does not present itself.
Former employees are the most common source of provider fraud referrals, often through a sealed qui tam whistleblower complaint that you will not know about for months. If you suspect a report, do not contact that person. Any outreach can be recast as witness tampering or retaliation, which turns a defensible billing dispute into a far more serious problem.
Provider investigations commonly run a year or more before anything visible happens, and the government has usually been working the file long before you learned of it. That is why the response window you are given — often two or three weeks — is deceptive. The clock has been running; it just started running for you.
Licensure action and exclusion from federal healthcare programs are separate proceedings from any criminal case, and they can be triggered by outcomes that look mild on paper. That is exactly why the resolution has to be built with the collateral consequences in mind from day one — a plea that solves the criminal exposure and ends the practice is not a win.
It depends on the posture: an audit response, a CID, a grand jury subpoena, and a filed indictment are very different pieces of work. We give you a straight scope and a straight number during the case review, so you can make a business decision with full information.
Accused as a benefits recipient rather than a provider? That's a different case with a different defense — see our Michigan welfare fraud defense page.
Your license, your enrollment, your payments, and your practice are all on the table at once — and they move on different timelines. The first two weeks decide how many of them you keep. Let's talk before the deadline, not after.