Healthcare Compliance Laws: Stark, Anti-Kickback, and False Claims

Introduction

Healthcare companies operate within a compliance framework that has no parallel in other industries. Three federal statutes constrain how healthcare companies structure business relationships, compensate physicians, and bill government programs. For healthcare bankers, these laws are not abstract legal concepts. They create material liability exposure in M&A transactions, require specialized due diligence beyond standard financial analysis, and directly affect how deals are structured, particularly in healthcare services where physician employment and referral relationships are central to the business model.

This article covers the three core compliance laws, what they prohibit, and why they matter for deal analysis.

The Stark Law (formally the Physician Self-Referral Law, 42 U.S.C. 1395nn) prohibits physicians from referring Medicare or Medicaid patients for "designated health services" (DHS) to entities with which the physician (or an immediate family member) has a financial relationship, unless a specific exception applies.

Designated Health Services (DHS)

The categories of services covered by the Stark Law's self-referral prohibition. DHS includes clinical laboratory services, physical therapy, occupational therapy, radiology and imaging, radiation therapy, durable medical equipment, home health services, outpatient prescription drugs, and inpatient/outpatient hospital services. Essentially, if a physician refers a Medicare patient for any of these services to an entity the physician has a financial interest in, the Stark Law applies.

The key features of the Stark Law that matter for banking:

The Anti-Kickback Statute (AKS, 42 U.S.C. 1320a-7b) makes it a federal crime to knowingly and willfully offer, pay, solicit, or receive anything of value to induce or reward referrals of patients covered by federal healthcare programs.

Where Stark is narrow (only physicians, only DHS, only Medicare/Medicaid), the AKS is broad: it applies to anyone (physicians, hospitals, device companies, pharma reps, management companies), covers any federal healthcare program, and prohibits any form of remuneration (cash, gifts, free services, below-market rent, lavish dinners, consulting fees) that is intended to influence referrals.

Safe Harbors

Regulatory provisions that protect specific payment arrangements from Anti-Kickback prosecution if all conditions are met. Key safe harbors include: fair market value personal services agreements, employment relationships, bona fide discounts, investment interests in large entities, and management contracts. Like Stark exceptions, safe harbors have detailed technical requirements. An arrangement that mostly fits a safe harbor but misses one element is not protected.

The AKS differs from Stark in several ways that matter for deal analysis:

The False Claims Act (FCA, 31 U.S.C. 3729-3733) is the federal government's primary tool for combating healthcare fraud. It imposes liability on anyone who knowingly submits (or causes the submission of) false or fraudulent claims for payment to the government.

The FCA is the enforcement mechanism that gives Stark and AKS their teeth. When a Stark violation or AKS violation leads to claims being submitted to Medicare or Medicaid, each such claim becomes a potential False Claims Act violation. The math escalates quickly:

The FCA is the most financially significant healthcare compliance law. The Department of Justice has recovered over $75 billion in FCA settlements and judgments since 1986, with healthcare consistently accounting for the majority of recoveries. Major settlements regularly exceed $500 million, and several have topped $1 billion.

These three laws collectively shape healthcare M&A in several concrete ways:

Due diligence scope. Healthcare acquisitions require compliance-specific due diligence that goes beyond financial and operational analysis. This includes reviewing billing patterns, physician compensation arrangements, referral relationships, government audit history, and internal compliance program effectiveness. In healthcare services transactions, compliance due diligence can take as long as financial due diligence.

Purchase agreement provisions. Healthcare M&A agreements include specialized representations and warranties around regulatory compliance, government program participation, billing practices, and physician relationships. Indemnification provisions for compliance-related losses typically have longer survival periods (3-6 years or indefinite) than standard representations (12-18 months).

Valuation impact. Known compliance issues directly reduce enterprise value through expected settlement costs, remediation expenses, and the risk of program exclusion. Unknown compliance risk is reflected in higher buyer discount rates and wider bid-ask spreads.

Beyond these US-specific compliance laws, healthcare companies also face political and legislative risk from policy changes that can reshape the competitive landscape, from drug pricing reform to CMS reimbursement rule changes.