FCA Now

In the span of one week, the United States Department of Justice (DOJ) announced three False Claims Act (FCA) settlements built on the same theory: each organization allegedly had reason to know it had been overpaid and kept the money anyway.

• Signal Diagnostics LLC agreed to pay $20.5 million (September 30, 2026) for allegedly avoiding repayment of COVID-19 testing claims to the Health Resources & Services Administration’s (HRSA’s) Uninsured Program that its own audit had flagged as ineligible.
• Independence Blue Cross agreed to pay $22.5 million (September 30, 2026) for allegedly ignoring chart reviews that failed to support Medicare Advantage diagnosis codes it had already submitted.
• AIDS Healthcare Foundation agreed to pay $1.44 million (October 6, 2026) for allegedly failing to investigate and delete unsupported Medicare Advantage diagnosis codes.

These settlements, brought in the context of DOJ’s ongoing emphasis on healthcare fraud enforcement, underscore that DOJ continues to aggressively enforce “reverse false claims” actions.

In Each Case, the Alleged Fraud Came After the Organization Had Reason to Know of Improper Payment

Signal Diagnostics. Signal billed HRSA’s COVID-19 Uninsured Program for testing and specimen collection between October 2020 and March 2022. According to the government, Signal began an internal audit around January 2022 and “determined that it had submitted claims to the Uninsured Program that were ineligible” because the patients had insurance. The government alleges that Signal “continued to conduct its audit” through May 2023 and, during that period, “knowingly and improperly avoided obligations to repay HRSA for overpayments.” (DOJ release.)

Independence Blue Cross. For payment years 2017 through 2021, IBX ran a chart review program in which nurse reviewers “identified all medical conditions that the charts supported.” IBX used the results of its chart reviews to identify instances where IBX could seek additional payments from CMS, but when those reviews did not support codes IBX had already submitted, the government alleges, “IBX did not delete or withdraw those diagnosis codes, which would have required IBX to reimburse CMS.” The government also alleges IBX “falsely certified in writing to CMS that the data was accurate and truthful.” A former IBX employee filed the qui tam and will receive $3,825,000. United States ex rel. Crawford v. Independence Blue Cross, No. 20-cv-5818 (E.D. Pa.). (DOJ release.)

AIDS Healthcare Foundation. AHF’s managed care division ran Medicare Advantage special-needs plans for HIV patients. The government alleges that, “for payment years 2017 to 2023,” AHF “failed to timely investigate and delete diagnosis codes that were either inaccurate or not documented in medical records.” A former AHF risk-adjustment coder filed the qui tam and will receive $259,200. United States ex rel. Irons v. AIDS Healthcare Foundation, No. 23-cv-2160 (C.D. Cal.). (DOJ release.)

All three resolutions are settlements of allegations. None involved a determination of liability. Signal’s matter, notably, came without a relator: the government built the case on its own.

The FCA Treats a Knowingly Retained Overpayment as a Reverse False Claim

The FCA’s reverse-false-claims provision imposes liability on anyone who “knowingly conceals or knowingly and improperly avoids or decreases an obligation to pay or transmit money or property to the Government.” 31 U.S.C. § 3729(a)(1)(G). The statute defines “obligation” to include a duty arising “from the retention of any overpayment.” Id. § 3729(b)(3). Submission of a false statement is not required. Knowingly keeping the money is enough.

For Medicare and Medicaid, Congress added a deadline. A provider, supplier, or Medicare Advantage organization must report and return an overpayment within 60 days after it is “identified,” and an overpayment kept past that date “is an obligation” for FCA purposes. 42 U.S.C. § 1320a-7k(d).

CMS’s current regulations, effective January 1, 2025, tie “identified” to the FCA’s knowledge standard. A Medicare Advantage (MA) organization “has identified an overpayment when the MA organization knowingly receives or retains an overpayment.” 42 C.F.R. § 422.326(c). For Parts A and B, the rule also suspends the 60-day deadline for up to 180 days while a provider conducts a timely, good-faith investigation into related overpayments. 42 C.F.R. § 401.305(b)(3)(ii).

Two features of these settlements stand out against that framework:

• The 60-day statute is not the only trigger. Signal’s overpayments came from an HRSA pandemic program, not Medicare or Medicaid. The FCA’s definition of “obligation” reaches “the retention of any overpayment” all the same. Government contractors face the same exposure: the Federal Acquisition Regulation’s (FAR’s) Prompt Payment clause requires a contractor that “becomes aware” of an overpayment to remit it and notify the contracting officer. FAR 52.232-25(d).
• An open-ended audit is not a safe harbor. The 2025 rule gives Part A and B providers up to 180 days to investigate. The government alleges Signal audited for roughly 16 months. IBX and AHF allegedly failed to act on investigation findings for years. Some courts have rejected the idea that the clock waits for a final number: in Kane v. Healthfirst, the Southern District of New York held that the clock starts when a provider is “put on notice of a potential overpayment.” United States ex rel. Kane v. Healthfirst, Inc., 120 F. Supp. 3d 370, 388 (S.D.N.Y. 2015).

The 2025 rule is friendlier to providers in one respect: by adopting the FCA’s knowledge standard, it removed liability for mere negligence in identifying overpayments. Most of the conduct in these settlements predates that rule. But the allegations here arguably go beyond negligence: in all three cases, the organization’s own audit or chart review allegedly surfaced the problem.

Treat Audit Findings as the Start of a Repayment Clock

These settlements give compliance teams a concrete checklist:

1. Start the clock when the audit finds a problem, not when the audit ends. Document the date an internal review first points to an overpayment. Medicare Part A and B providers should track the 180-day investigation window from that date.
2. Scope the investigation before it starts. Set a defined lookback period, a sampling method, and an end date. An audit with no end date invites the allegation that the organization chose to keep the overpaid money.
3. Repay what you know while you quantify the rest. Returning any confirmed amount early limits the “knowingly retained” exposure while the broader review continues.
4. Act on both sides of a chart review. For MA organizations, a chart review that identifies codes to be added should also identify codes without support that must be deleted.
5. Look beyond Medicare. Grant recipients, pandemic-program participants, and government contractors carry the same obligation under the FCA’s definition of “obligation” and, for federal contractors, under FAR 52.232-25(d).
6. Assume an employee is watching. Two of the three cases began as qui tams filed by former employees, including a risk-adjustment coder. The people who run the audit are the most likely relators.

For more on how and when to approach the government, see our earlier post, FCA Basics: Government Investigations and Self-Disclosure.

Fix the Refund Process Before a Relator Tests It

DOJ’s message is simple: an overpayment becomes FCA exposure the day an organization knows about it and chooses not to act. Organizations that receive federal funds should review their audit and refund protocols now, with a defined investigation timeline and a decision-maker accountable for repayment.