Ten Essential Healthcare Laws

Anyone familiar with the American healthcare industry recognizes it as one of the most heavily regulated sectors in the U.S. Healthcare providers, digital health companies, management services organizations (MSOs), and sophisticated investors, whether already established in this dynamic arena or just entering it, must comply with a number of mandatory statutory and regulatory frameworks at both the federal and state levels. HHS’s Office of Inspector General (OIG) provides a general overview of some of these.

Seemingly simple, innocuous mistakes can unexpectedly trigger civil penalties, mandatory exclusion from federal healthcare programs, or even criminal liability. A broader challenge for these entities is that healthcare laws rarely operate in neat isolation. A single compensation arrangement, patient referral relationship, or data-sharing practice may implicate several distinct statutes at once, inviting concurrent enforcement actions from multiple federal agencies.

Below is an introductory overview of ten federal laws that frequently shape the operations of healthcare entities. Please note that this overview only serves as a general educational summary rather than formal legal advice and that applying these statutes actually is a fact-specific endeavor.

Found at 42 U.S.C. § 1320a-7b(b), the federal Anti-Kickback Statute (AKS) is one of the most well-known healthcare laws and prohibits knowingly and willfully offering, paying, soliciting, or receiving remuneration to induce patient referrals or generate business payable by federal healthcare programs like Medicare, Medicaid, and TRICARE. In most other industries, arrangements like these are both common and perfectly lawful. Healthcare, however, works differently, a fact that often surprises those new to the industry.

“Remuneration” broadly includes anything of value, from cash to free office rent or lavish travel. Because this criminal statute is intent-based and has broad applicability, the federal government has also created so-called “safe harbors.” These safe harbors are voluntary but, when fully satisfied, protect a particular arrangement from prosecution. Common safe harbors protect bona fide employment, personal services and management contracts, space and equipment rentals, and certain investment interests. Importantly, failure to satisfy an AKS safe harbor perfectly does not automatically make the arrangement illegal. Instead, evaluating the arrangement becomes fact-specific and also looks to the parties’ actual intent behind it.

Nonetheless, AKS violations can lead to exclusion from federal healthcare reimbursement as well as criminal fines or (in severe cases) imprisonment. Furthermore, under a 2010 amendment by Congress, claims tainted by a kickback are automatically treated as false claims under the False Claims Act (see Section 3 below).

HHS OIG conducts AKS investigations and can impose administrative remedies, whereas the U.S. Department of Justice (DOJ) handles prosecution and litigation. A meaningful share of that caseload also originates with private “relators,” individuals who file qui tam suits that DOJ then decides whether to join.

The federal Physician Self-Referral Law (42 U.S.C. § 1395nn), also known as the Stark Law, prohibits a physician from referring Medicare patients for certain “designated health services” (DHS) to an entity with which that physician (or the physician’s immediate family member) shares a financial relationship, unless a specific statutory exception applies. DHS examples include the following:

Under the Stark Law, “physicians” include doctors of medicine, osteopathy, dental surgery, dental medicine, podiatric medicine, and optometry as well as chiropractors. Stark exceptions include in-office ancillary services, bona fide employment, and personal service arrangements, among others.

Unlike the intent-based AKS, the Stark Law imposes strict liability, meaning intent is irrelevant. Where a financial relationship exists and no exception is fully satisfied, both the referral and any resulting claim are prohibited. Stark violations can result in denied claims, mandatory refunds, and legal exposure under the False Claims Act.

Multiple agencies share responsibility for enforcing the Stark Law: the Centers for Medicare & Medicaid Services (CMS) administers the statute, DOJ litigates the False Claims Act cases that follow, and OIG imposes civil monetary penalties and exclusion for knowing violations.

The False Claims Act (31 U.S.C. §§ 3729-3733) is the federal government’s main tool for going after fraud. It creates serious liability for anyone who knowingly submits a false claim for payment to the federal government or causes someone else to submit one. In healthcare, these cases usually come from a handful of familiar practices: billing at a higher code than the service warrants, billing for services that were never provided, providing care the patient did not need, and submitting claims that are tainted by an AKS or Stark Law violation.

The statute’s “knowing” standard extends well beyond actual knowledge and includes deliberate ignorance as well as reckless disregard. A business cannot, therefore, insulate itself from liability by simply declining to ask difficult questions. The statute imposes treble damages (i.e., the damages award is tripled) along with significant per-claim penalties.

Additionally, the law’s unique qui tam provisions empower private whistleblowers, known as relators, to file lawsuits on the government’s behalf and receive a large share of any financial recovery. This whistleblower mechanism actually accounts for a large portion of modern healthcare enforcement, meaning disgruntled employees, attentive competitors, or even patients can spur investigations that DOJ may ultimately choose to join. This often catches healthcare entities off-guard.

While OIG and Medicare program integrity contractors (such as UPICs, RACs, and MACs) are frequently involved to some degree, only DOJ can litigate these cases. A whistleblower’s qui tam complaint is filed under seal and served on DOJ, giving the government time to investigate and decide whether to join the case.

The Civil Monetary Penalties Law (42 U.S.C. § 1320a-7a) grants OIG wide authority to impose penalties for many kinds of misconduct, including submitting improper claims, violating AKS, offering improper financial inducements to program beneficiaries, and employing people who have been excluded from federal healthcare programs. Penalties can run from $10,000 to $50,000 per violation and can be cumulative. Because CMPL works through administrative channels instead of criminal courts, the government has a lower burden of proof, which lets OIG settle matters efficiently through negotiated agreements and corporate integrity agreements. This gives the federal government a faster, more flexible option alongside criminal cases and False Claims Act suits to hold parties accountable without bringing a full criminal prosecution.

Under 42 U.S.C. § 1320a-7, OIG has the power to bar people and companies from taking part in federal healthcare programs. Some exclusions are mandatory, such as those triggered by certain criminal convictions, while others are left to the agency’s discretion. The effects are serious. An excluded party cannot bill federal programs directly or indirectly, and hiring or contracting with an excluded person can lead to steep penalties. Thus, healthcare organizations must screen regularly against OIG’s List of Excluded Individuals and Entities (LEIE).

Enacted in 2018 as part of the SUPPORT Act, the Eliminating Kickbacks in Recovery Act (18 U.S.C. § 220) prohibits knowingly and willfully paying, offering, soliciting, or receiving remuneration in exchange for referring a patient to a laboratory, recovery home, or clinical treatment facility, or in exchange for an individual’s use of those services.

EKRA catches many healthcare organizations off-guard because it is not limited to federal healthcare programs the way AKS is. Instead, it reaches any “health care benefit program,” which covers commercial insurance and, under most readings, cash-pay arrangements. An arrangement can thus have nothing to do with Medicare or Medicaid and still expose someone to fines of up to $200,000 and ten years in prison for each violation.

EKRA’s exceptions are also much narrower than AKS’s safe harbors, especially with regard to how a company pays its people. The employee and contractor exception does not protect pay that varies with how many patients were referred, how many tests or procedures were performed, or how much was billed or collected. Thus, a percentage-based commission can satisfy the AKS bona fide employment safe harbor and still violate EKRA.

DOJ enforces EKRA directly as a criminal statute. HHS has issued no implementing regulations or safe harbors, and OIG advisory opinions do not address it, leaving healthcare organizations with less advisory guidance than they are accustomed to under AKS.

Enacted as the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and later expanded by the Health Information Technology for Economic and Clinical Health (HITECH) Act, this legislative framework governs the delicate privacy and security of protected health information (PHI).

Much of HIPAA actually stems from various federal regulations. The HIPAA Privacy Rule restricts how covered entities and business associates may use and disclose PHI. Once PHI is de-identified under either HIPAA’s safe harbor method or the expert determination standard, it is no longer PHI and the Privacy Rule no longer applies. The HIPAA Security Rule institutes administrative, physical, and technical safeguards for electronic PHI, whereas the HIPAA Breach Notification Rule mandates timely notice to affected individuals, regulators, and occasionally the media following a security breach.

Any vendor handling PHI on behalf of a covered entity is legally classified as a “business associate” and must execute a formal Business Associate Agreement (BAA), while downstream subcontractors are similarly bound.

The HHS Office for Civil Rights can impose large civil money penalties, and state attorneys general can bring their own HIPAA enforcement actions. HIPAA also overlaps more and more with the FTC’s authority over unfair and deceptive practices, along with a growing set of state consumer health privacy laws. As a result, one data practice often has to comply with several regulatory frameworks at the same time.

The Emergency Medical Treatment and Labor Act, also known as EMTALA (42 U.S.C. § 1395dd), requires Medicare-participating hospitals with emergency departments to provide a full medical screening exam to anyone who comes in seeking emergency care as well as to stabilize or properly transfer anyone with an emergency medical condition. This applies no matter whether the patient can pay or has insurance. Historically, Congress passed EMTALA to prevent hospitals from turning away or “dumping” uninsured emergency patients. The duty attaches the moment a patient walks in and binds both the hospital and on-call physicians.

Violations can bring steep civil money penalties, the loss of a hospital’s Medicare provider agreement, and private lawsuits from harmed patients, who may sue hospitals directly for personal injury damages under the statute’s civil remedy.

EMTALA is enforced jointly by CMS, which investigates complaints and can terminate a hospital’s Medicare provider agreement; HHS OIG, which imposes civil money penalties against both hospitals and responsible physicians and can exclude repeat or flagrant violators; and private plaintiffs.

The Controlled Substances Act (21 U.S.C. § 801 et seq.) governs the manufacture, distribution, dispensing, and prescribing of controlled substances, administered by the DEA. Prescribers and pharmacies must hold valid DEA registrations and comply with demanding recordkeeping requirements. The CSA carries particular significance for healthcare organizations, given the evolving rules on remote prescribing under the Ryan Haight Act and the repeated extensions of pandemic-era flexibilities that temporarily relaxed the in-person examination requirement.

The Federal Food, Drug, and Cosmetic Act (21 U.S.C. § 301 et seq.) gives the FDA authority over the safety, effectiveness, and marketing of drugs, biological products, medical devices, and similar products. For healthcare businesses, the FDCA matters most in areas like off-label promotion, software that works as a medical device (SaMD), drug compounding, and the claims a company makes about its products and services. The statute’s misbranding and adulteration rules also tend to overlap with and amplify legal exposure under the False Claims Act.

Ultimately, these diverse statutes are not independent of each other. A single business arrangement can trigger several at once. For instance, a poorly structured compensation formula may violate AKS, taint the resulting claims under the False Claims Act, and expose the parties to civil monetary penalties and program exclusion. Similarly, a modest data privacy lapse can lead to concurrent enforcement under HIPAA and state consumer protection laws, and a prescribing model must satisfy the CSA, HIPAA, and state corporate practice of medicine doctrines together.

For any healthcare organization, the takeaway is that deliberate structuring matters immensely. Compensation formulas, referral networks, data-handling procedures, and clinical governance should each be designed with these overlapping regimes in mind and documented carefully enough to show that the applicable safe harbors and statutory exceptions are actually satisfied.

Disclaimer: This industry insight is for general information only, is not legal advice, and does not create an attorney-client relationship.