The New Frontier of Telehealth Enforcement: Navigating DOJ's Sharpened Focus on Fraud

2026-08-17

The rapid expansion of telehealth has ushered in a new era of healthcare delivery, but it has also attracted the attention of federal enforcement agencies. With the Department of Justice establishing a new National Fraud Enforcement Division, healthcare providers must understand and prepare for a significantly heightened landscape of scrutiny.

The landscape of healthcare delivery has been irrevocably transformed by the rapid adoption of telehealth. What began as a convenience has evolved into an essential component of care, particularly post-pandemic, facilitating access and efficiency across diverse patient populations. However, this transformative growth has also presented new vulnerabilities, capturing the keen attention of federal enforcement agencies. The Department of Justice (DOJ) has made it unequivocally clear: telehealth is now a primary target in its invigorated fight against healthcare fraud. For founders, operators, and compliance officers, this is not merely a headline; it's a strategic imperative demanding immediate attention and robust action.

> For more on this topic, see our analysis: [The Enforcement Hammer Falls: Navigating the DOJ's Sharpened Focus on Telehealth Fraud](/blog/doj-telehealth-fraud-enforcement-trends).

The Department of Justice's Game-Changing Strategy: The NFED

In a decisive move to centralize and expand its capabilities, the DOJ recently announced the establishment of the National Fraud Enforcement Division (NFED). This is not a reorganization but an amplification of federal resources dedicated to combating fraud across critical sectors, with healthcare, and specifically telemedicine, at the forefront. The NFED is designed to be 'lean, flat, and agile,' indicating a proactive and rapid response capability, backed by a significant increase in headcount, including more prosecutors, agents, and forensic accountants embedded in U.S. Attorney's Offices nationwide.

> For more on this topic, see our analysis: [The Enforcement Hammer Falls: Navigating the DOJ's Sharpened Focus on Telehealth Fraud](/blog/doj-telehealth-fraud-enforcement-trends).

This new division's mandate includes leveraging advanced data analytics to proactively identify fraudulent schemes. Historically, enforcement has often been reactive, responding to whistleblower tips or egregious cases. The NFED's approach signifies a shift towards data-driven identification and prevention, analyzing vast datasets of billing, prescribing, and claims information to spot patterns indicative of fraud, waste, and abuse. This means that any statistical anomaly or deviation from normative practice within your operations is now more likely to be flagged for investigation. For telehealth providers, who operate primarily in a digital environment, the digital footprints of their operations are now under unprecedented scrutiny.

Key Areas of Enhanced Enforcement Focus

The DOJ has explicitly outlined its priority areas, leaving no ambiguity about where its expanded resources will be directed.

Telemedicine-Specific Fraud

The rise of telehealth has unfortunately been accompanied by a surge in fraudulent schemes tailored to its unique delivery model. The NFED will be targeting a range of illicit activities, including:

Billing for Medically Unnecessary Services: This is a perennial target, but in telehealth, it often manifests as billing for consultations or treatments that lack a legitimate medical basis, driven by profit motives rather than patient need. This can include prescribing medications or ordering durable medical equipment (DME) without proper clinical assessment.
Services Not Rendered: Charging for telehealth consultations that never occurred, or for longer durations than actually provided.
Kickbacks and Illegal Referrals: Schemes involving payments or inducements for patient referrals, particularly those steering beneficiaries to specific telehealth platforms, pharmacies, or labs. This often violates the Anti-Kickback Statute (AKS), which carries severe civil and criminal penalties.
Upcoding and Misrepresentation: Billing for higher-acuity services than those actually provided, or misrepresenting the nature of a telehealth visit to maximize reimbursement.
Identity Theft and Impersonation: Using stolen patient identities to bill for telehealth services or for providers to impersonate licensed professionals.

Controlled Substance Diversion via Telehealth

The DOJ's intensified focus extends directly to the prescribing of controlled substances through telehealth. While federal waivers during the public health emergency expanded telehealth prescribing flexibilities, the underlying risks of diversion and misuse remain high. The NFED, in coordination with the Drug Enforcement Administration (DEA), will scrutinize:

Inappropriate Prescribing: Cases where controlled substances are prescribed without a legitimate medical purpose, outside the usual course of professional practice, or without adequate patient evaluation.
Pill Mill Operations: Telehealth platforms that facilitate high-volume, indiscriminate prescribing of controlled substances.
Lack of Proper Documentation: Failure to maintain comprehensive medical records justifying the medical necessity and appropriateness of controlled substance prescriptions. As the DEA continues to evaluate the scheduling of various substances, such as its proposed rescheduling of suvorexant, lemborexant, and daridorexant to Schedule V, the regulatory environment around controlled substances remains dynamic, further highlighting the need for rigorous compliance in prescribing practices.

Medicare and Medicaid Billing Integrity

Telehealth providers participating in federal programs like Medicare and Medicaid are under particularly heavy scrutiny. The NFED's enhanced data analytics capabilities will allow for unprecedented oversight of claims data. Recent changes from CMS underscore this push for greater accountability and specificity:

FQHCs and RHCs Billing Changes: CMS is mandating a significant billing change for Federally Qualified Health Centers (FQHCs) and Rural Health Clinics (RHCs), requiring them to transition from a generic distant-site telehealth code (G2025) to specific service codes for non-behavioral telehealth by October 1, 2026. This move towards granular billing codes is a clear signal that CMS intends to track and audit telehealth services with greater precision, reducing opportunities for vague or inflated claims.
ACCESS Model for Chronic Care: Concurrently, CMS introduced the Advancing Chronic Care with Effective, Scalable Solutions (ACCESS) Model, a voluntary program that ties payments to outcome-aligned, technology-supported chronic care services. While voluntary, this model highlights CMS's strategic shift towards value-based care where technology, including telehealth and remote monitoring, must demonstrate measurable health outcomes. Such models inherently demand robust data integrity and a clear audit trail, leaving little room for fraudulent claims that do not align with patient improvement.
Specific Service Exclusions: Furthermore, specific federal rules, such as the recent CMS final rule prohibiting federal Medicaid and CHIP funding for 'sex-rejecting procedures' for minors, demonstrate how targeted policy decisions can create new compliance obligations and potential fraud risks if providers fail to adjust their billing practices accordingly. Any claims submitted contrary to such specific prohibitions could be considered false claims.

The Interplay with State-Level Compliance

While the DOJ's focus is federal, state-level compliance failures can often be the precursor or direct evidence for federal fraud investigations. State medical boards and licensing agencies enforce professional standards and scope of practice rules, which, if violated, can lead to improper billing or medically inappropriate care, triggering federal scrutiny.

Consider the recent clarification from the California Medical Board regarding the permissible scope of practice and supervision for Medical Assistants (MAs). This guidance emphasizes that MAs are unlicensed individuals limited to non-invasive technical support under direct, on-premises supervision. If a telehealth clinic operating in California were to improperly utilize MAs to perform services outside their scope – for instance, conducting initial patient assessments or performing invasive procedures – and subsequently bill for those services, it could create a significant risk. Such a practice could be seen as misrepresenting the provider of service or the nature of the service, potentially leading to false claims charges, even if the primary violation began at the state regulatory level. The ultimate responsibility for appropriate supervision and adherence to scope of practice laws rests squarely with the licensed professional and the practice itself.

The Financial and Reputational Stakes are Higher Than Ever

For any healthcare organization, the consequences of federal fraud enforcement are severe and multi-faceted:

False Claims Act Liability: The False Claims Act (FCA) is the government's primary tool for combating fraud against federal programs. Violations can lead to treble damages (three times the amount of the fraudulent claim) plus significant per-claim penalties, often in the tens of thousands of dollars per claim. This can quickly bankrupt a practice.
Exclusion from Federal Healthcare Programs: Providers found guilty of fraud can be excluded from participating in Medicare, Medicaid, and other federal healthcare programs, effectively shutting down their primary revenue streams.
Civil and Criminal Charges: Individuals and organizations can face both civil monetary penalties and criminal prosecution, leading to hefty fines, imprisonment, and loss of professional licenses.
Reputational Damage: Beyond legal and financial penalties, an enforcement action can destroy a practice's reputation, eroding patient trust and making it impossible to attract talent or secure partnerships.

What This Means For Your Practice: Proactive Compliance as a Strategic Imperative

The message from the DOJ is unambiguous: proactive and robust compliance is no longer optional; it is a fundamental pillar of sustainable telehealth operations. Healthcare leaders must recognize this heightened enforcement environment and take immediate, decisive action.

1. Strengthen Your Compliance Program: A strong compliance program is your first line of defense. This must go beyond a check-the-box exercise. It requires: * Regular Risk Assessments: Identify specific vulnerabilities related to your telehealth services, billing practices, and controlled substance prescribing. * Comprehensive Policies and Procedures: Develop clear, written policies covering billing, documentation, medical necessity, supervision requirements (including for unlicensed personnel), and controlled substance protocols. * Mandatory and Ongoing Training: Ensure all staff, from clinicians to administrative personnel, are thoroughly trained on compliance policies, regulatory updates, and the consequences of non-compliance. * Internal Auditing and Monitoring: Implement regular internal audits of claims, medical records, and prescribing patterns to identify and correct issues *before* they attract external scrutiny. * Reporting Mechanisms: Establish clear channels for employees to report concerns without fear of retaliation.

2. Meticulous Documentation is Paramount: In a telehealth environment, your digital records are your primary evidence of legitimate care. Every encounter, prescription, and billing entry must be supported by comprehensive, accurate, and timely documentation that clearly justifies medical necessity and adheres to clinical guidelines. Generic templates or insufficient notes are now significant liabilities.

3. Review Billing Practices with a Fine-Tooth Comb: Conduct a thorough review of all billing codes, modifiers, and reimbursement rules for telehealth services. Ensure absolute accuracy in claims submissions to federal programs and commercial payers. Pay close attention to changes like the FQHC/RHC billing mandate and the specific exclusions under the CMS final rules.

4. Due Diligence on Vendors and Partners: The AKS and Stark Law remain potent enforcement tools. Carefully vet all third-party vendors, marketing agencies, and referral partners to ensure their practices do not create impermissible financial relationships or inducements that could be construed as kickbacks. This includes ensuring any AI tools or technology platforms utilized align with regulatory requirements and do not inadvertently generate fraudulent billing patterns.

5. Stay Abreast of Regulatory Changes: The regulatory landscape for telehealth is highly dynamic. Ongoing monitoring of federal (DOJ, OIG, CMS, DEA) and state-specific (medical boards, state Medicaid agencies) updates is non-negotiable. What was permissible last year may not be today.

TrueEval: Your Infrastructure for Compliant Telehealth Growth

Navigating this complex and increasingly scrutinized environment requires more than just good intentions; it demands purpose-built infrastructure. TrueEval stands as the definitive partner, providing the technology and expertise to operationalize compliance at scale. Our solutions empower telehealth founders and operators to:

Automate Compliance Workflows: Embed regulatory requirements directly into your clinical and administrative processes, reducing human error and ensuring consistent adherence.
Centralize Regulatory Intelligence: Stay ahead of dynamic federal and state mandates with real-time updates and actionable insights, ensuring your policies are always current.
Streamline Documentation and Auditing: Facilitate meticulous record-keeping and provide tools for robust internal audits, demonstrating adherence to medical necessity and billing integrity.
Mitigate Risk: Proactively identify and address potential vulnerabilities before they escalate into enforcement actions, protecting your financial health and reputation.

In this new era of heightened enforcement, the future of telehealth belongs to those who prioritize compliance not as an afterthought, but as an integrated, strategic advantage. TrueEval provides the bedrock upon which secure, scalable, and compliant telehealth businesses are built, enabling you to focus on delivering exceptional patient care while we safeguard your regulatory standing.