AI Coding and Documentation Tools Under the False Claims Act: The 60-Day Clock

This session opens with the enforcement environment providers now face: DOJ’s record $6.8 billion in FCA settlements and judgments in FY2025, more than $5.7 billion of it from healthcare, a record 1,297 qui tam filings, and the DOJ-HHS FCA Working Group’s stated priorities, including manipulation of EHR systems and an express commitment to enhanced data mining. The speakers then return to the FCA fundamentals that still control, working through falsity, causation, scienter, and materiality as each applies when a technology platform recommends the code and a human ultimately submits the claim. They examine the government’s own data analytics, DOJ’s 2026 FOCUS Initiative inviting sophisticated data-mining relators, and the limits that Integra v. Providence, the public disclosure bar, and Rule 9(b) place on statistics-only theories, framed as “Signal versus proof.” The session surveys where AI-assisted coding, CDI tools, ambient scribes, and automated risk-adjustment prompts cross the line, then closes with The Villages Health case study and the $14.1 million Complete Health settlement, walking every FCA element from unsupported diagnosis through self-disclosure and cooperation credit.

The second hour moves from the government’s case to the provider’s response, built around two interactive scenarios. In the first, a coding audit identifies 25 potentially unsupported diagnoses, and the audience works through whether an overpayment has been identified, how broad the lookback should be, and when the 60-day clock begins under the 2025 amendment to 42 C.F.R. § 401.305, which now suspends the return deadline during a timely, good-faith investigation for up to 180 days. In the second, an employee reports that the company’s AI coding tool has been systematically recommending unsupported diagnoses, introducing the separate 120-day clock under DOJ’s Corporate Whistleblower Awards framework alongside contractual notice obligations and subpoena timing. The speakers then turn to vendor risk when someone else built the algorithm: pre-implementation diligence, the contract provisions that matter, and the practical indemnification problem when the vendor is thinly capitalized and the government is not bound by the parties’ private allocation of FCA risk. The session closes by mapping HHS-OIG’s seven compliance program elements onto AI-specific governance, monitoring, auditing, escalation, and board oversight, ending with the question every client should be asked: “If DOJ or a data-mining relator ran its analytics against your claims tomorrow, what would it see—and have you already run the same analysis yourself?”