#74: No Breach, Big Trouble: FCA Risks in Healthcare

Cybersecurity headlines love a good hack story. This week, we talk about something far sneakier that can cost you plenty even when nothing gets “hacked.” On Cash in the Cyber Sheets, we unpack how the False Claims Act can bite health care organizations and vendors when their compliance story does not match reality. Translation: you can be on the hook for big dollars without a single compromised record if your security attestations, certifications, or program claims are inaccurate. That is not a typo. No breach. Still massive exposure.

We walk through real enforcement patterns where the government alleged false attestations tied to federal health program dollars. Think Meaningful Use incentive attestations about doing a proper security risk analysis, or software certification claims about logging and controls, or contract compliance certifications around cybersecurity safeguards. In each theme, the common thread is simple. Money flows only when specific conditions are met. If you certify that boxes are checked when they are not, the False Claims Act turns into a very expensive compliance teacher.

For medical practices, this is especially relevant. Many assume HIPAA risk equals “what happens if we have a breach.” Important, yes, but incomplete. The bigger blind spot is whether your documentation and certifications accurately reflect the controls you say you run. Do you actually conduct and review your risk analysis at the depth required, or is it a quick once over with a template? Are your technical controls implemented as described in policies and vendor attestations, or are there gaps that would make those statements misleading? Are you relying on your EHR and other vendors to carry the compliance water without verifying their claims and your obligations as a program participant or contractor?

We break this into practical takeaways you can act on. How to scope and document your risk analysis so it is more than a checkbox. What to ask vendors about certifications and test conditions before you trust their marketing. How to align policy words with operational reality so your attestations are truthful, specific, and defensible. We also cover how to prepare for auditors and investigators who will request evidence, not adjectives. No scare tactics, just straight talk, clear steps, and our usual professionally playful commentary to keep the compliance caffeine flowing.

Bottom line for this episode. False Claims Act exposure can arise even when no breach occurs. Your best defense is disciplined documentation, controls that actually run, and attestations grounded in verifiable evidence. Bring your compliance team, your practice manager, and yes, your EHR rep. Everyone has homework after this one.