Most Medicaid fraud investigations take one to five years from the first inquiry to a final resolution. Straightforward billing cases sometimes wrap up faster, and complex multi-party schemes can run considerably longer. How long a Medicaid fraud investigation takes depends mostly on three things: the complexity of the alleged conduct, whether the case resolves civilly or heads to criminal trial, and how quickly the parties involved produce records and answer questions.
The Two Stages an Investigation Moves Through
Federal regulations require state Medicaid agencies to work through a two-stage process, and understanding those stages explains where the months and years actually go.
Preliminary Investigation
When a state Medicaid agency receives a complaint or spots a questionable billing pattern, it must first conduct a preliminary investigation to decide whether a full investigation is warranted.1eCFR. 42 CFR 455.14 – Preliminary Investigation Investigators pull claims data, billing records, and supporting documentation to test whether the initial suspicion holds up. This phase can run anywhere from a few weeks to several months, driven mostly by how many records need to be reviewed.
Full Investigation and Referral
If the preliminary review turns up reason to believe fraud occurred, the agency must refer the case to the state’s Medicaid Fraud Control Unit. In states without a certified MFCU, the agency conducts the full investigation itself or hands it to law enforcement.2eCFR. 42 CFR 455.15 – Full Investigation When beneficiary fraud is suspected, the case goes straight to a law enforcement agency.
The full investigation is where the timeline stretches. Investigators subpoena patient records, internal policies, correspondence, and billing data. They interview staff and patients, and bring in medical and billing specialists to compare treatment patterns against accepted standards. If a federal grand jury gets involved, prosecutors will build the case carefully before seeking an indictment, adding months or years.
What Makes One Case Faster Than Another
Complexity is the biggest variable. A solo practitioner who upcoded a few hundred claims produces a very different investigation than a multi-state billing company running a kickback scheme across dozens of clinics. More entities means more records to subpoena, more interviews to conduct, and more jurisdictions to coordinate. Cases requiring cooperation between the Department of Justice, the HHS Office of Inspector General, and one or more state MFCUs move slower simply because each agency has its own caseload.
How the target responds matters too. Providers who produce documents promptly and make staff available for interviews help the case move. Providers who stall, fight every subpoena, or destroy records will see things drag on, and obstruction can create separate legal exposure. Resources on the government side also play a role. MFCUs vary in size and funding from state to state, and some carry heavier caseloads than others.
The resolution method is the final driver. A provider who negotiates a civil settlement can often close things out in two to three years. A case headed to criminal trial almost always takes longer, because prosecutors won’t bring charges until they’re confident the evidence supports a conviction beyond a reasonable doubt.
How Far Back the Government Can Reach
Investigations don’t stay open forever, but the government has a longer runway than many people expect. Under the False Claims Act, a civil suit must be filed within six years of the fraudulent conduct, or within three years of when the responsible government official learned (or should have learned) the key facts, whichever is later. That second option has a hard outer limit: no suit can be filed more than ten years after the violation.3U.S. Department of Justice. The False Claims Act
This matters for timeline expectations. A qui tam whistleblower complaint filed under seal can sit with the Department of Justice for years while the government investigates, and the provider often has no idea the case exists until the seal is lifted. By the time you learn you’re a target, the investigation may already be well developed.
Criminal healthcare fraud charges under federal law generally carry a five-year statute of limitations, though certain circumstances can extend that window. Even if a billing issue feels long behind you, the government may still have time to act on it.
What to Do If Investigators Contact You
If you’re a provider or an employee approached by investigators, the choices you make early shape how long and how badly the case affects you.
You have the right to retain an attorney before answering any questions, and using that right early is almost always worth the cost. You also have Fifth Amendment protections against self-incrimination. In voluntary interviews, you can decline to answer without facing discipline for the refusal alone, though anything you do say can be used in both criminal and administrative proceedings. Ask investigators two things upfront: whether the interview is voluntary or compelled, and whether you are a subject of the investigation or a witness. The answers determine what protections apply and how much risk cooperation carries.
During the investigation, the government may issue subpoenas for documents, audit your billing records, and interview your staff. You’re generally required to comply with lawful document requests. Destroying, altering, or hiding records is a separate federal offense that can produce charges even if the underlying fraud allegation turns out to be unfounded.
How Investigations End
The length of a case is bound up with how it resolves, and the government has a range of tools.
Some investigations simply close. If the evidence doesn’t support fraud, that’s the end of it. In other cases, the evidence shows billing errors or overpayments but falls short of proving intent to defraud, and the matter gets referred back to the state Medicaid agency for overpayment recovery rather than prosecution.
Civil enforcement is the government’s most common outcome. Under the False Claims Act, anyone who knowingly submits a false claim to a federal healthcare program is liable for three times the government’s actual damages plus a per-claim penalty. As of July 2025, that per-claim penalty ranges from $14,308 to $28,619.4Federal Register. Civil Monetary Penalties Inflation Adjustments for 2025 Because each individual bill submitted to Medicaid counts as a separate claim, penalties add up quickly.
The most serious cases end in criminal prosecution. The federal Health Care Fraud statute makes it a crime to knowingly execute a scheme to defraud any healthcare benefit program. The maximum penalty is 10 years in prison, rising to 20 years if the fraud causes serious bodily injury and to life imprisonment if it causes death.5Office of the Law Revision Counsel. 18 US Code 1347 – Health Care Fraud Criminal fines can reach $250,000 for individuals and $500,000 for organizations.6Office of the Law Revision Counsel. 18 US Code 3571 – Sentence of Fine
Providers who settle civil cases but want to keep participating in federal healthcare programs often sign a Corporate Integrity Agreement. A CIA lasts five years and imposes compliance obligations including a designated compliance officer, an independent reviewer, and annual reports to the OIG.7Office of Inspector General. Corporate Integrity Agreements Serious cases can also result in exclusion, which bars a provider from receiving any payment from Medicare, Medicaid, and other federal healthcare programs.8Office of Inspector General. Exclusions Program
Shortening the Timeline Through Self-Disclosure
The one lever a provider genuinely controls is coming forward first. Under federal law, once you identify an overpayment you must report and return it within 60 days, or by the due date of any corresponding cost report, whichever is later.9Federal Register. Medicare Program – Reporting and Returning of Overpayments Missing that deadline turns a retained overpayment into an obligation under the False Claims Act, exposing you to treble damages and per-claim penalties on money you could have simply returned.
For situations that go beyond routine billing errors, the OIG runs a Provider Self-Disclosure Protocol. Providers who identify potential fraud in their own operations can report it voluntarily, and the OIG generally resolves these matters with lower damage multipliers than it would pursue in a contested case.10Office of Inspector General. Self-Disclosure Information Self-disclosure also compresses the timeline dramatically. Instead of a multi-year investigation with subpoenas and interviews, the provider and the government work from a shared factual record from the start, and cases often resolve in a fraction of the time a contested investigation would take.