Why 45% of Whistleblower Cases Now Start With a Spreadsheet

The Spreadsheet Revolution in Qui Tam Cases

Whistleblower cases used to run on memory. A billing manager knew her hospital was overbilling Medicare. An engineer watched his contractor pad labor hours on a federal contract. They reported what they had seen, and if investigators found them credible, a case moved forward. Everything rested on one person's recollection and on how well that recollection survived cross-examination.

That foundation has shifted. Court data from 2024–2025 indicates that roughly 45% of qui tam whistleblower cases filed in federal court relied on systematic data mining or spreadsheet analysis as their primary evidence source. The shift is not coincidental. Numbers don't get flustered on the stand, don't misremember dates, and don't carry the appearance of a grudge. A defense attorney can attack a witness's motives; attacking a reproducible calculation drawn from the government's own published data is far harder.

The scale of what is at stake explains the change. The Justice Department reported that False Claims Act settlements and judgments exceeded $6.8 billion in fiscal year 2025 — the highest single-year total in the statute's history with more than $5.3 billion of that coming from whistleblower-initiated cases. Relators filed 1,297 qui tam lawsuits that year, shattering the previous record of 980 set in 2024. Cumulative recoveries since the 1986 amendments now exceed $85 billion.

What a qui tam case actually is

A qui tam case is a lawsuit filed by a private citizen called a relator — on behalf of the U.S. government against someone who submitted false claims for federal payment. The False Claims Act, the statute underlying qui tam, exposes violators to treble damages (three times the government's loss) plus a civil penalty for each false claim submitted.

That per-claim penalty deserves attention, because the number most articles quote is decades out of date. The statute itself says $5,000 to $10,000, but Congress requires annual inflation adjustments. As of the most recent DOJ adjustment, the range is $14,308 to $28,619 per claim. A hospital that submitted 10,000 improper claims faces penalty exposure in the hundreds of millions before damages are even calculated. If the case succeeds, the relator receives 15–30% of the total recovery.

The financial incentive has existed since 1986. What changed is how the evidence gets built.

Why the spreadsheet became the starting point

A compliance officer can now download Medicare billing data from CMS's public data portal, build a spreadsheet comparing her hospital's coding distribution to national averages, and surface systematic overpayment in an afternoon. An analyst at a defense contractor can cross-reference hours billed to federal contracts — visible in part through USAspending.gov — against internal project records. A nonprofit program manager can compare participant counts claimed in grant reports against actual attendance logs.

None of this requires a statistics degree or a litigation budget. It requires a data set, a benchmark, and a few hours.

The reason it works is aggregation. A single patient coded as high-risk can be explained — clinical judgment, an unusual presentation, or a documentation quirk. A thousand patients coded high-risk when the clinical records show otherwise is not a judgment call. It is a pattern, and patterns are what separate error from conduct. They don't prove intent on their own, but they go directly to the legal question that matters: whether the defendant acted knowingly, which under the FCA includes reckless disregard and deliberate ignorance, not just deliberate fraud. A pattern is very difficult to characterize as an accident.

For anyone weighing whether to come forward, starting with data offers three concrete advantages:

• It produces objective evidence before you expose yourself. You learn whether your suspicion holds up before anyone knows you had one.
• It lets you investigate independently. Much of the underlying data is public, which means you may not need to touch confidential company files — a distinction that matters legally, since improperly taking employer documents has damaged relators' credibility and cases.
• It changes how you're received. Attorneys and government investigators field a great many hunches. A relator who arrives with a benchmarked analysis and a dollar figure is a different conversation entirely.

Understanding Qui Tam and the False Claims Act

Data mining only makes sense once you understand what qui tam is and why the False Claims Act carries the weight it does.

The False Claims Act is codified at 31 U.S.C. § 3729 et seq. Congress passed it in 1863 to combat Civil War procurement fraud and has amended it repeatedly since — most consequentially in 1986, when the modern whistleblower provisions were restored, and again through the Fraud Enforcement and Recovery Act of 2009 and the Affordable Care Act in 2010. The principle is simple: anyone who knowingly submits a false claim to the federal government for payment is civilly liable.

A false claim is any bill, invoice, or certification submitted for federal funds that contains false information. Healthcare providers bill Medicare and Medicaid. Defense contractors bill for labor and materials. Universities and nonprofits draw down federal grants. If those submissions are false — or if a required certification is false in a way that mattered to the payment decision — the FCA applies.

Why the numbers get so large

The damages formula is what turns a billing problem into a nine-figure headline.

The government recovers treble damages — three times the loss it actually sustained — plus a civil penalty for every individual false claim. Not per scheme. Per claim. Every line item, every invoice, every submitted encounter.

That per-claim penalty is currently $14,308 to $28,619, adjusted annually for inflation. (The $5,000–$10,000 figure written into the statute in 1986 is still widely quoted and has not been the operative number for decades.)

Run the math on a hospital that received $100 million it should not have:

In practice, courts have signaled that penalties disconnected from actual harm can raise Eighth Amendment excessive-fines problems, and most matters settle well below the theoretical ceiling. But the ceiling is the leverage. Defendants settle in the hundreds of millions precisely because litigating to judgment risks a number that could end the company.

The provision that changes everything

Qui tam is shorthand for a Latin phrase meaning "who sues on behalf of the king as well as for himself." It allows a private citizen to sue in the government's name.

The relator gets direct standing to sue. No permission from a federal agency is required. No government employment is required. An employee, a former employee, a competitor, a subcontractor, or an outside analyst can file — provided two threshold rules are satisfied, and this is where data-driven relators most often stumble:

The first-to-file rule. Only the first relator to file on a given set of facts can recover. A second suit alleging the same underlying fraud gets dismissed. If your analysis has surfaced something significant, someone else may be looking at the same numbers.

The public disclosure bar. Under 31 U.S.C. § 3730(e)(4), a case can be barred if the allegations were already publicly disclosed — in federal reports, hearings, news media, or prior litigation — unless the relator qualifies as an original source. This one deserves attention from anyone building a case from public data. Working entirely from published CMS or USAspending figures does not automatically bar your claim, but it raises the question. The safest position is being able to show that your analysis, your insider knowledge, or your synthesis materially added to what was already public. Discuss this with counsel before you file, not after.

The seal period

A qui tam complaint is filed under seal. The defendant is not served. The docket is not public. No press.

The statute sets a minimum of 60 days, and that number gets repeated as though it were the norm. It is not. The government routinely moves for extensions "for good cause," and courts routinely grant them. Seals lasting one to three years are ordinary; in one Fifth Circuit case the government obtained eighteen extensions across roughly eight years.

Plan for a long wait. During the seal you generally cannot discuss the case with anyone but your attorney — including your spouse, your colleagues, and any journalist who calls.

Intervention

During the seal, DOJ's Civil Division investigates and decides whether to intervene. Its primary investigative instrument is the Civil Investigative Demand, an administrative subpoena under 31 U.S.C. § 3733 that compels documents, written answers, and sworn testimony. (Grand juries belong to parallel criminal investigations, which sometimes run alongside an FCA matter but are a separate track.)

If DOJ intervenes, government attorneys take primary responsibility for the case and work alongside the relator's counsel. Federal resources and federal credibility now attach to the allegations, and outcomes improve dramatically. If DOJ declines, the relator may proceed alone — permitted, but expensive and considerably harder.

What the relator recovers

The relator's share depends directly on that intervention decision:

• Government intervenes: 15–25% of the recovery
• Government declines and the relator litigates alone: 25–30%

The higher percentage compensates for carrying the entire burden. It is a larger slice of a much less likely recovery.

On a $100 million intervened settlement, the relator's share runs roughly $15–25 million. Awards of that size have produced a professional ecosystem around the statute: a specialist qui tam bar working on contingency, forensic accountants and data analysts retained pre-filing, and firms that actively mine public datasets looking for anomalies worth investigating. In FY 2025, DOJ reported approximately $330 million in relator share awards.

How Spreadsheet Analysis Has Transformed Whistleblower Evidence

Before 2010 — The testimony era

Qui tam cases were built on what an insider saw. Success turned on the relator's credibility and recall, which handed the defense a reliable playbook: the witness was disgruntled, the witness misunderstood a complex billing rule, the witness is remembering three years later what he never fully understood at the time. There was little to check that testimony against. Medicare physician payment data sat behind a federal injunction that had blocked its publication since 1979.

2010–2015 — The data becomes public

Two things converged. Congress broadened FCA liability through the Fraud Enforcement and Recovery Act of 2009 and the Affordable Care Act in 2010. Then, in April 2014, CMS released its first Physician and Other Supplier Public Use File — utilization and payment records covering more than 880,000 providers, roughly 10 million records, and over $77 billion in Medicare payments — after a court vacated the long-standing injunction.

For the first time, anyone could benchmark a provider against national norms without insider access. Early analyses were simple: how does this hospital's coding distribution compare to everyone else's? That question had been effectively unanswerable a year earlier.

2016–2019 — The courts raise the bar, and data answers it

The Supreme Court's decision in Universal Health Services v. Escobar (2016) imposed a rigorous materiality standard: it is not enough that a claim was false, the falsity must have been capable of influencing the government's payment decision. Combined with Rule 9(b)'s demand that fraud be pleaded with particularity, relators needed to show scale and significance at the complaint stage, before any discovery.

Statistical analysis turned out to be the most efficient way to do that. A pattern spanning thousands of claims and quantified in dollars speaks to materiality in a way a single anecdote cannot. Courts also began working through when statistical sampling can be used to establish liability across a large claim population — a question that remains genuinely contested and circuit-dependent.

2020–present — The default starting point

Data analysis is now where most serious cases begin. Relators' firms retain forensic accountants and analysts before filing. DOJ runs its own analytics, particularly in Medicare Advantage risk-adjustment matters, where the entire theory of the case is a comparison between diagnosis codes submitted and medical records that support them.

The volume reflects it: whistleblowers filed 1,297 qui tam suits in FY 2025, the most in the statute's history and well above the prior record of 980.

The relationship between evidence types has inverted. Analysis establishes the scope and the pattern; testimony explains what the pattern means and how it came about. Neither wins alone — but the spreadsheet now comes first.

Types of Fraud That Spreadsheet Analysis Uncovers

Different frauds leave different fingerprints in the data. Knowing which category you may be looking at tells you what to compare, what to control for, and what a defensible analysis needs to include.

One caution before the categories: statistical variance is a lead, not a conclusion. A provider whose numbers sit far from the national mean may be committing fraud, or may be a tertiary referral center receiving the sickest patients, or may have recently invested in documentation training that captures conditions its peers miss. The analysis identifies where to look. What you find when you look — the clinical records, the internal emails, the policy that instructed staff how to code — is what turns an anomaly into a case.

Billing fraud

The largest category by volume and by recovery.

In healthcare, the recurring patterns are upcoding (billing a diagnosis or procedure as more severe than the record supports), unbundling (billing separately for services required to be billed as a package), and phantom services (billing for care never delivered).

Coding distribution is the standard first test. If a provider codes 40% of cases at the highest severity level against a national average of 15%, that gap is the starting question. It becomes evidence when the underlying clinical documentation doesn't support the coding — and when the pattern holds across procedure types, time periods, and physicians, which is what distinguishes a policy from a coder's misunderstanding.

In defense and government contracting, the analogues are labor mischarging (hours billed exceeding hours worked, or hours shifted from a fixed-price contract to a cost-reimbursable one), material cost inflation, and inflated subcontractor pass-throughs.

Timesheet reconciliation is the core technique: hours billed to a federal contract against hours reflected in internal project schedules, badge-in records, or scheduling systems. An employee charged at 50 hours a week to a government contract whose internal records show 40 is a discrepancy of ten hours. Across 200 employees and three years, it is a quantifiable loss to the government — which is precisely the form the complaint needs to take.

Cost reporting fraud

Hospitals and other institutional providers file annual Medicare cost reports allocating overhead and indirect costs across service lines. The allocation methodology determines reimbursement, and it involves genuine discretion — which is exactly why it can be manipulated.

Two signals are worth charting. The first is a step change: allocations that shift sharply in one reporting period with no corresponding change in operations, service mix, or physical plant. The second is peer divergence: allocations that differ materially from how comparable institutions treat the same cost categories. Cost report data is available through CMS's Healthcare Cost Report Information System, which makes multi-year and peer comparison feasible.

Kickbacks and induced referrals

The category most likely to be missed by someone reasoning purely from billing volume.

Under 42 U.S.C. § 1320a-7b(g), a claim arising from an Anti-Kickback Statute violation is automatically a false claim under the FCA. Payment doesn't have to be a bag of cash — speaker fees, consulting agreements, above-market rent, free staffing, and waived copays have all supported cases.

The data signature is a relationship, not a level: referral volume that tracks payments to a referring physician, or a lab whose ordering pattern from one practice diverges sharply from every other practice it serves. This is where correlation analysis earns its place. Two of DOJ's larger FY 2025 healthcare resolutions involved kickback allegations, including a $202 million settlement over the use of speaker programs.

Medically unnecessary services and risk adjustment

The fastest-growing data-driven area.

In Medicare Advantage, plans are paid based on enrollees' documented health status. Diagnoses that inflate a risk score without clinical support inflate payment. The analysis compares diagnosis codes submitted for risk adjustment against what the medical record actually supports — and a particularly telling variant looks for asymmetry: chart reviews and in-home assessments that add lucrative diagnoses at high rates while almost never deleting unsupported ones.

The related theory covers procedures performed at volumes no patient population would clinically justify — cardiac stents, spinal procedures, hospice enrollment for patients not terminally ill.

Compliance certification fraud

An organization certifies it meets a requirement — cybersecurity controls, FDA manufacturing standards, grant conditions, prevailing wage rules — when it does not, and then submits claims for payment.

Two qualifications matter here, and most articles skip them. First, liability can rest on an express certification or an implied one, where submitting a claim implicitly represents compliance. Second, after Escobar, the false certification must be material to the government's payment decision. Evidence that the government kept paying with full knowledge of the noncompliance cuts strongly against materiality.

Cybersecurity certifications are now a stated DOJ priority through its Civil Cyber-Fraud Initiative, which pursues contractors that misrepresent their security controls or fail to report breaches.

Eligibility fraud

Billing federal programs for beneficiaries or participants who do not qualify — patients outside Medicaid income or enrollment criteria, grant participants who don't meet program requirements, borrowers or applicants who fail statutory eligibility tests.

The technique is a cross-reference: billed population against the eligibility file, matched on identifiers. What makes it persuasive is systematic mismatch. Isolated errors happen in every program; a consistent rate of ineligible billing that persists across periods indicates a process that was never designed to check, or was designed not to.

Reverse false claims

Often overlooked and worth understanding, because it inverts the usual logic.

Under 31 U.S.C. § 3729(a)(1)(G), liability attaches to avoiding an obligation to pay the government — not just to taking money improperly. The most common healthcare version is knowingly retaining an identified overpayment beyond the 60-day repayment deadline. In trade, it covers undervalued or misclassified imports that reduce duties owed, an area DOJ has emphasized heavily through its Trade Fraud Task Force.

The data question is different in shape: not what did they claim but what did they owe and not pay.

The Data Analyst's Toolkit: How to Spot Fraud in Numbers

None of what follows requires statistical training or specialized software. All of it can be done in Excel or Google Sheets.

Before you start, two ground rules.

Work from data you are lawfully entitled to have. Public datasets are always safe. Data you access in the ordinary course of your job is generally fine to look at. Copying, forwarding, or removing confidential employer records is a different matter — relators have damaged strong cases and exposed themselves to counterclaims doing it. If your analysis requires internal data, talk to a qui tam attorney about how to handle it before you download anything.

Write down your method as you go. Data source, date pulled, filters applied, formulas used, exclusions and why. If this becomes a case, someone will need to reproduce your work. An analysis nobody can replicate is an opinion.

1. Comparative analysis

Calculate a metric for your organization and compare it to peers or a national benchmark.

Example: Your hospital codes 35% of deliveries as high-risk. National Medicare data shows 12%. That 23-point gap is your starting question.

What separates a real finding from a false alarm: compare like to like. A tertiary referral center receiving high-risk transfers should code more complications than a community hospital. Before treating a gap as meaningful, narrow the peer group by bed size, teaching status, region, and case mix — and check whether the gap holds across multiple procedure types. A single outlier metric is noise. The same provider sitting above the benchmark on eight unrelated measures is a pattern.

Where to get benchmarks: CMS public use files, state hospital discharge databases, HHS-OIG reports, and specialty society registries.

2. Anomaly detection

Identify values that fall outside the normal range.

The standard advice — calculate the mean and standard deviation, flag anything beyond 2–3 SD — will mislead you on billing data. Charge and utilization distributions are heavily right-skewed, with a long tail of legitimately expensive cases. A handful of extreme values inflates both the mean and the standard deviation, which pulls your threshold outward and hides the very providers you're looking for.

Use percentile ranks instead. Median and interquartile range are resistant to outliers in a way that mean and SD are not:

• Calculate the median: =MEDIAN(range)
• Calculate Q1 and Q3: =QUARTILE(range,1) and =QUARTILE(range,3)
• IQR = Q3 − Q1; flag anything above Q3 + 1.5 × IQR
• Or simply rank everything: =PERCENTRANK(range, value) and look at the top 1%

Guard against the small-denominator trap. A provider with 11 cases can land in the 99th percentile by pure chance. Set a minimum volume threshold — often 30 to 50 cases — before including anyone in the comparison. Percentile outliers built on tiny samples are the single most common way a promising analysis falls apart.

Example: Peer hospitals average $25,000–$30,000 for a knee replacement. Yours averages $47,000. Worth pursuing — after you confirm the comparison covers the same procedure codes, the same payer mix, and enough volume to be stable.

3. Time-series analysis

Chart a metric across months or years and look for inflection points.

Example: A contractor bills 40 hours per week per employee to a federal contract, steadily, for three years. In month 37 it jumps to 55. In month 38, to 60. Step changes of that shape rarely happen organically.

The essential discipline here is ruling out legitimate causes. Before treating a break as suspicious, check what else changed at that moment:

• Regulatory or coding changes — the ICD-10 transition in October 2015, annual MS-DRG revisions, new CPT codes
• A contract modification, task order, or scope expansion
• An acquisition, a new service line, a new facility
• A genuine documentation or training initiative
• Seasonality — compare month 37 to month 25 and month 13, not just to month 36

If you can identify the change and it explains the break, you've saved yourself considerable trouble. If the numbers jump and nothing in the business changed, you have something worth pursuing.

4. Correlation analysis

Examine whether two variables move together in ways that shouldn't happen.

Example: A physician-owned imaging center receives referrals from twelve practices. Across eleven of them, referral volume tracks patient panel size. The twelfth refers at four times the rate its panel size predicts — and it happens to be the practice receiving medical director fees. That relationship is the entire evidentiary core of most kickback cases.

What correlation is not: a before-and-after comparison. If procedures per visit rise from 20 to 28 after a coding policy change, that's a time-series step change (technique 3), and it belongs there. Correlation asks whether two variables move together across cases — payments and referrals, ownership stake and utilization, and physician tenure and coding intensity.

In a spreadsheet: =CORREL(array1, array2), then plot the scatter. The visual usually tells you more than the coefficient. And correlation never establishes causation — it tells you where to ask why.

5. Benchmarking against explicit standards

Comparison against a written requirement rather than a peer average. Stronger than peer benchmarking, because the standard is fixed and documented — there is no argument about what the target was.

Example: A defense contractor certified compliance with the NIST SP 800-171 security controls required under DFARS 252.204-7012. You inventory the controls actually implemented against the 110 controls required and find a substantial shortfall. Because that certification was a condition of contract award, the gap is directly relevant to FCA exposure.

Other standards that work this way: Davis-Bacon prevailing wage determinations, Uniform Guidance cost principles for federal grants, FAR cost accounting standards, and grant-specific participation or eligibility requirements.

6. Digit and duplicate testing

A forensic accounting staple, and easy to run in a spreadsheet.

Benford's Law describes the leading-digit distribution of naturally occurring numbers: about 30% begin with 1, roughly 18% with 2, declining to under 5% for 9. Fabricated or manipulated figures often deviate noticeably. Extract leading digits with =LEFT(A2,1), count with COUNTIF, and compare against the expected distribution.

Also worth checking:

• Round-number clustering — invoices at exactly $5,000 or hours at exactly 40.0 far more often than chance allows
• Threshold bunching — amounts landing just below approval limits, or hours just below the point that triggers review
• Exact duplicates — the same amount, date, and vendor appearing more than once

None of these prove anything alone. All of them point you toward where to look next.

Data analysis matters most when it feeds a system rather than sitting in a one-off file. Organizations that combine anomaly detection, benchmarking against written standards, functioning internal reporting, and scheduled risk reviews catch problems while they are still correctable — before a relator finds them first. A structured risk and compliance management approach turns isolated findings into a repeatable process.

Whistleblower Protection: Why Reporting Carries Less Risk Than People Assume

The single most common reason people who see fraud don't report it is fear of retaliation. They assume the company will find out, the industry will find out, and their career will end. The fear is rational. It is also, in most respects, out of step with what the statute actually provides.

What § 3730(h) protects

The False Claims Act's anti-retaliation provision, 31 U.S.C. § 3730(h), prohibits an employer from discharging, demoting, suspending, threatening, harassing, or otherwise discriminating against an employee, contractor, or agent because of lawful acts done in furtherance of an FCA action or to stop an FCA violation.

Two features of the provision matter and are frequently misstated.

You do not have to file a qui tam case to be protected. Efforts to stop an FCA violation are protected on their own — reporting suspected fraud to a compliance officer, raising it with a supervisor, refusing to participate, or documenting concerns internally can all qualify. The seal never has to lift for the protection to attach.

Contractors and agents are covered, not only W-2 employees. Since the 2009 amendments the provision reaches independent contractors and agents of the company, which is meaningful for a workforce that includes contract analysts, temp coders, and consultants.

What you can recover

The statute authorizes "all relief necessary to make that employee, contractor, or agent whole." Specifically:

• Reinstatement with the same seniority the employee would have had
• Two times back pay, plus interest
• Compensation for special damages — attorneys' fees, litigation costs, and consequential losses

Note what is not on that list: general punitive damages beyond the doubled back pay. Articles that promise "punitive damages up to treble the lost wages" conflate this with FCA damages themselves, which is a different statute in a different chapter. The doubling of back pay is the statutory multiplier. Some plaintiffs also bring parallel state-law claims that carry additional damages, but that is a strategic layering, not something § 3730(h) provides on its own.

The burden the employee has to carry

To make out a retaliation claim you must show:

1. You engaged in protected activity (FCA-related conduct as defined above);
2. The employer knew about that activity;
3. You suffered an adverse action — termination, demotion, discipline, material change in duties;
4. The protected activity was causally connected to the adverse action.

Courts vary on the causation standard — some circuits apply "but-for" causation, others accept "motivating factor" — which is one reason a qualified attorney should shape the pleading rather than a template.

The employer's defense is that it would have taken the same action for legitimate reasons, and it must show that clearly and convincingly. In practice, retaliation cases turn on timing and pretext: an action that arrives soon after protected activity, or a stated reason that shifts, or discipline that departs from how similarly situated employees have been treated.

The realistic picture — and its limits

Timing is the strongest evidence a plaintiff has. An adverse action within weeks of a report is difficult for the employer to characterize as coincidence. As distance grows, the causal inference weakens; a firing six months out is still a viable claim, but no longer a presumptive one.

Two honest caveats belong in any accurate description of this landscape:

Retaliation cases can settle well, but they are not automatic wins. They require real litigation. You need counsel, you need documentation, and you need to survive summary judgment. "Fired within six months" is a strong starting position, not a self-executing verdict.

Statutory protection does not neutralize career effects the law cannot reach. § 3730(h) protects you against your current employer. It does not, in practice, control how your name moves through an industry or how a background check tells your story. Whistleblower-heavy industries — healthcare, defense contracting — handle this more openly than smaller sectors, but the effect exists.

The statute of limitations is short. § 3730(h) claims must be brought within three years of the adverse action. That is materially shorter than the underlying FCA limitations period. If you have been retaliated against, timing matters.

The one thing worth doing today

Whether or not you ever file, document.

Keep a contemporaneous record of every internal report: date, recipient, channel, and substance. Preserve emails you sent. Note who was in the room. If you follow up in writing to confirm a verbal conversation ("thanks for making time yesterday — as I mentioned, I wanted to flag…"), the confirmation itself becomes evidence. Keep the record somewhere outside company systems, since access can disappear the day the relationship changes.

The retaliation claims that succeed almost always have a paper trail. The ones that fail almost always don't.

Evidence Requirements: What Data Actually Proves Fraud

Not every spreadsheet supports a case. The FCA has specific pleading and proof standards, and understanding them tells you what your analysis needs to accomplish — and what it can't.

The pleading standard: Rule 9(b)

Federal Rule of Civil Procedure 9(b) requires that fraud be pleaded with particularity — the "who, what, when, where, and how" of the alleged fraud.

Circuits split on whether an FCA complaint must identify specific false claims by date and amount, or whether reliable indicia giving rise to a strong inference that false claims were submitted can suffice. The First, Fifth, Seventh, Ninth, and Eleventh Circuits accept some version of the more flexible approach; the Fourth, Sixth, Eighth, and Eleventh have at times required greater specificity. This is one of the most consequential open questions in FCA litigation, and where you file matters.

For a data-driven relator, the practical implication is direct: statistical patterns alone are unlikely to satisfy 9(b) in a strict-pleading circuit. Your analysis needs to point to representative example claims — specific patients, specific invoices, specific dates — so the complaint can name particulars. This is a place where public data alone is often insufficient and insider knowledge of specific submissions supplies what the analysis cannot.

The materiality standard: Escobar

Since the Supreme Court's 2016 decision in Universal Health Services v. Escobar, the falsity or non-compliance you allege must have been material to the government's payment decision — meaning it had "a natural tendency to influence, or be capable of influencing," the payment.

Escobar explicitly listed factors that cut against materiality, and one of them decides many cases: evidence that the government kept paying claims despite knowing about the non-compliance is strong evidence that the non-compliance was not material. If your theory is that Medicare would never have paid had it known, and the record shows Medicare knew and paid anyway, the theory collapses.

Data analysis is where materiality is often shown. Scope, dollar magnitude, and systematic (rather than incidental) violation are all quantitative arguments about whether the conduct mattered.

The scienter standard: what "knowingly" means

The FCA's scienter requirement covers three states of mind:

• Actual knowledge that the information is false
• Deliberate ignorance of truth or falsity
• Reckless disregard for truth or falsity

The Supreme Court sharpened this in United States ex rel. Schutte v. SuperValu Inc. (2023): what matters is the defendant's subjective belief at the time of the conduct, not what an objectively reasonable person would have thought. A defendant who genuinely believed its interpretation of an ambiguous rule was correct is not liable, even if that interpretation was wrong. A defendant who knew or suspected its interpretation was wrong is liable, even if a court might later have accepted the argument.

For your evidence, this means the internal record — emails, training materials, meeting notes, warnings that were ignored — matters more than ever. Patterns in the data prove the conduct was systematic; the internal record proves the company knew.

The proof standard at trial

The government or relator must prove FCA violations by a preponderance of the evidence — more likely than not. This is the ordinary civil standard, meaningfully lower than the "beyond a reasonable doubt" standard in criminal cases and also lower than "clear and convincing evidence" (which applies to a few specific issues within FCA litigation, such as the employer's defense in a § 3730(h) retaliation case).

A rigorous statistical analysis of a large claim population, combined with representative example claims and documentary evidence of knowledge, comfortably meets a preponderance standard for most theories.

Strong evidence vs. weak evidence

Strong:

• Specific false claims identified by date, amount, and patient or invoice
• A statistical pattern spanning enough claims to rule out random variation, controlled for plausible confounders
• Documentary evidence of knowledge — the email instructing coders to select the highest severity regardless of documentation, the compliance audit that flagged the issue and was shelved, the policy that formalized the shortcut
• Contemporaneous internal warnings that were dismissed or overridden
• The organization's own regulator or auditor flagging the outlier before you did

Weak:

• A single anomalous claim, unless the amount is very large and the falsity is unambiguous
• Statistical differences without controls for legitimate explanations — case mix, patient acuity, service line, geography
• Inference of intent from outcome — "the numbers went up, so they must have known"
• Analysis built on a data window too short to distinguish a pattern from a fluctuation
• Small sample sizes that place individual providers at the extremes by chance

The pattern in the strong list is that data and documents corroborate each other. The analysis shows scale and system; the documents show mind. Neither on its own tends to be enough.

DOJ's Role: How the Government Investigates a Qui Tam Case

Whether DOJ intervenes is the single most important factor in whether a qui tam case succeeds. Understanding how that decision is actually made — and how long it takes — sets realistic expectations for anyone considering filing.

Filing and the seal

The complaint is filed in federal district court under seal, served on the government but not on the defendant. The docket is not public. There is no press release, no notification to the company, no service of process.

The statute sets a minimum seal period of 60 days. That number is technically accurate and practically misleading. The government routinely moves for extensions "for good cause," and courts routinely grant them. Seals lasting one to three years are ordinary; longer is not unusual. In one Fifth Circuit case, the government obtained eighteen extensions over roughly eight years.

Plan accordingly. During the seal you generally cannot discuss the case with anyone but your attorney — not your spouse, not your former colleagues, and not the reporter who has started calling.

What DOJ actually does during the investigation

The Civil Division reviews the complaint and the relator's evidence, then decides how far to investigate. Its primary tool is the Civil Investigative Demand — an administrative subpoena under 31 U.S.C. § 3733 that can compel documents, written interrogatory answers, and sworn oral testimony from the defendant or third parties.

DOJ may also:

• Interview the relator, sometimes repeatedly
• Interview current and former employees of the defendant
• Coordinate with the relevant Office of Inspector General (HHS-OIG for healthcare, DoD-OIG for defense, and so on)
• Run its own data analysis, often more sophisticated than what the relator brought in
• Coordinate with the U.S. Attorney's Office in the district of filing, which frequently takes the lead

Grand juries belong to parallel criminal investigations, which sometimes run alongside an FCA matter but are a separate track. A qui tam complaint is a civil filing.

What the intervention decision actually turns on

There is no formal legal standard DOJ must apply to decide intervention. The decision is discretionary and weighs several factors — the strength of the evidence, the size of potential recovery, resource priorities within the Civil Division, whether the theory of liability is legally sound after Escobar and SuperValu, and whether the case aligns with current enforcement priorities (Medicare Advantage, kickbacks, cybersecurity, PPP, and pandemic fraud are all elevated at the moment).

Cases can end four ways at the intervention stage:

1. Intervene — DOJ takes over as lead counsel and litigates or negotiates settlement, with the relator's counsel in a supporting role.
2. Decline — DOJ steps back and the relator may proceed alone.
3. Partial intervention — DOJ pursues some counts or defendants and declines others.
4. Move to dismiss. This is the option most articles skip. Under 31 U.S.C. § 3730(c)(2)(A), DOJ can move to dismiss a qui tam case over the relator's objection. Following the 2018 Granston Memo, DOJ began exercising this authority more actively, and the Supreme Court confirmed the broad scope of that power in United States ex rel. Polansky v. Executive Health Resources (2023). A case DOJ views as weak, meritless, or contrary to government interests can be terminated even if the relator wants to continue.

The numbers that actually matter

The intervention rate is often quoted at 40%. It is meaningfully lower than that.

Across the last decade, DOJ has intervened in — or otherwise pursued — roughly 20 to 25 percent of qui tam cases. The vast majority of recoveries come from those cases. In FY 2025, DOJ reported more than $5.3 billion in whistleblower-initiated recoveries out of $6.8 billion in total, and the overwhelming share of that flowed from intervened matters.

The success gap between intervened and declined cases is very wide. Intervened cases settle or resolve favorably at rates commonly reported in the 90%+ range — because DOJ largely intervenes in cases it expects to win. Declined cases the relator litigates alone succeed far less often, with published estimates typically in the single digits to low teens. This is not because declined cases are unwinnable. It is because they are more expensive, slower, and harder to prosecute without government subpoena power and government credibility at the settlement table.

The practical implication is direct: evidence quality drives everything. DOJ declines cases with weak evidence, and declined cases rarely succeed. This is why qui tam attorneys spend heavily on pre-filing analysis, and why the data-first approach this piece describes has become standard.

FCA enforcement now extends to areas that would have surprised practitioners a decade ago, including cybersecurity compliance for government contractors. The Cybersecurity False Claims Act piece walks through how misrepresenting security controls or failing to report incidents can create FCA exposure — a fast-growing enforcement theory tied directly to DOJ's Civil Cyber-Fraud Initiative.

Risks and Protections: An Honest Assessment

Filing a qui tam case is not a low-risk undertaking. Nor is it as dangerous as its reputation suggests. What follows is what a realistic reader should weigh — the categories most explainers understate as well as the ones they overstate.

Financial risk

Attorney fees. Nearly all qui tam counsel work on contingency, meaning no fees upfront. Recovery-share arrangements typically run 33% to 40% of the relator's award, higher on more difficult cases. If a case fails, the relator generally owes no fees, but the retainer agreement will spell out cost obligations — expert fees, filing costs, litigation expenses — which sometimes remain the relator's responsibility. Read that document carefully before you sign.

Costs beyond fees. Even on contingency, complex cases generate five- and six-figure costs for expert witnesses, forensic accountants, and discovery. Firms typically advance these against future recovery, but again, the agreement controls.

Adverse fee awards. Under 31 U.S.C. § 3730(d)(4), a defendant that prevails against a qui tam case DOJ declined can move for its attorneys' fees if the court finds the claim was clearly frivolous, clearly vexatious, or brought primarily for harassment. The bar is high and awards are rare, but the risk is not zero. This is one of the strongest arguments for filing only with experienced counsel.

Counterclaims. Defendants sometimes bring counterclaims for breach of confidentiality, breach of employment agreement, or misappropriation of documents. Courts have generally held that counterclaims aimed at neutralizing the FCA recovery are barred, but claims that would exist independent of the qui tam case can proceed. This is where the "don't take employer documents" advice from earlier matters most. Relators who improperly copied confidential files have faced viable counterclaims and, in some cases, reduced or forfeited awards.

Taxes. Relator awards are taxable as ordinary income in the year received. On a large award the federal, state, and self-employment tax burden can approach half. Attorneys' fees paid from the award are generally deductible above-the-line, but the mechanics are complex. Consult a tax advisor before the check clears, not after.

Employment risk

Retaliation is illegal, and § 3730(h) provides real remedies — reinstatement, doubled back pay, special damages, and attorneys' fees. But three things are worth being honest about:

• Enforcing your rights requires a lawsuit. Success turns on timing and documentation.
• The remedy is compensatory, not preventative. It runs after the retaliation, not before.
• The three-year statute of limitations on § 3730(h) claims is materially shorter than the FCA's underlying limitations period.

Internal reporting through a documented compliance channel before or alongside a qui tam filing tends to reduce retaliation risk — and it strengthens the retaliation claim if retaliation does occur, because the employer's knowledge of your protected activity is on the record.

Career risk

The effects the law cannot reach.

Industry effects vary considerably. Healthcare and defense contracting have large enough whistleblower populations and enough turnover that filing a qui tam case is not a career-ending event, and some relators build second careers in compliance consulting or plaintiff-side work. Smaller and more relationship-driven industries are harder. Reference calls, informal networks, and reputational effects operate outside any statute.

Two adjacent effects worth planning for: the seal eventually lifts, and the relator's identity becomes public when it does; and depending on the case, media coverage may follow.

Legal risk

Most qui tam cases do not result in recovery. Published data consistently shows roughly 20–25% of filed cases produce a settlement, judgment, or other recovery for the relator. Nearly all of those are DOJ-intervened matters. Declined cases the relator litigates alone succeed only occasionally.

Two threshold rules cause a large share of dismissals before the merits are ever reached:

• First-to-file. 31 U.S.C. § 3730(b)(5) bars a second-filed case alleging the same underlying facts. If someone else has already filed on your theory, your case is out.
• Public disclosure bar. § 3730(e)(4) bars cases whose allegations were already publicly disclosed unless the relator qualifies as an "original source." Cases built entirely on public data — the CMS files, USAspending, prior lawsuits, news coverage — are vulnerable here. Insider knowledge that materially adds to what was public is what typically clears the bar.

Reduced-share provisions. Under § 3730(d)(3), a relator who "planned and initiated" the violation can have their share reduced or eliminated, and a relator convicted of criminal conduct arising from the violation is barred from any share. This matters most in cases where the relator was an active participant in the scheme, not simply a witness to it.

The one protection worth acting on immediately

The initial consultation.

Nearly every experienced qui tam firm offers a free, confidential first consultation. There is no cost to describe what you have observed, share your analysis, and hear an honest assessment of whether it supports a case, whether someone else may have filed first, whether the public disclosure bar is a concern, and what a realistic recovery might look like.

None of that commits you to anything. It gives you the one thing the internet cannot: a professional evaluation of your specific facts, before you make an irreversible decision either way.

Building Your Qui Tam Case: A Practical Playbook

If you suspect fraud and want to test that suspicion against the data, the order of operations matters. Getting steps out of sequence — particularly touching internal files before you understand what you can legally take — is where readers most often damage their own cases.

Step 1: Talk to an attorney before you gather anything internal

This is the reordering that matters most.

If your analysis will rest entirely on public data — CMS files, USAspending, published inspector-general reports, court records — you can proceed to Step 2. Nothing about pulling those files creates legal exposure.

If your analysis needs internal company data, stop and get counsel first. What you can lawfully preserve depends on your role, your access, your employment agreement, and applicable state law. Relators who reflexively copied confidential files onto personal devices have faced viable counterclaims for breach of contract, breach of fiduciary duty, and trade-secret claims — and courts have reduced or forfeited relator shares as a result. Nearly every qui tam firm offers a free confidential consultation. Use it before you start moving documents.

Step 2: Frame the question and locate the data

A useful analysis starts with a specific, testable hypothesis, not a vague suspicion.

• Weak: "I think we're overbilling."
• Better: "I think our emergency department is using CPT 99285 at a rate substantially above peer hospitals of similar size and case mix, and that the underlying documentation doesn't support the level of service billed."

Once the question is that specific, the data you need becomes obvious. For that example: your facility's E/M code distribution over a defined period, national or state benchmarks from CMS, and enough clinical context to know what documentation should support each level.

Common public sources:

• CMS public use files — Medicare provider utilization and payment
• USAspending.gov — federal contract and grant awards
• HHS-OIG reports — audits, investigations, industry-wide analyses
• SAM.gov — federal contracting records
• State transparency portals, Medicare cost reports, and specialty-society registries

Step 3: Establish a defensible baseline

An anomaly is only anomalous relative to something. What "normal" looks like depends on what you're comparing.

• For billing patterns: peer providers matched on size, teaching status, patient mix, and geography — not raw national averages that lump a critical-access hospital in with an academic medical center.
• For labor charging: hours reflected in internal project schedules, badge or access logs, or standard staffing for comparable roles.
• For cost allocation: the organization's own prior-year methodology, or peer allocations from cost reports.
• For compliance certifications: the written requirement itself — the NIST controls, the DFARS clause, the grant condition. Explicit standards beat peer averages because there is no argument about what the target was.

Write the baseline down and cite it. "The national average" without a source will not survive scrutiny.

Step 4: Run the analysis — and rule out the obvious explanations

Apply the techniques from earlier: comparative analysis, percentile-based outlier detection, time-series checks for inflection points, correlation for relationships that shouldn't exist, and Benford's or duplicate testing where fabrication is plausible.

Then do the harder work: actively look for the innocent explanations. Before treating a finding as evidence of fraud, ask:

• Did a coding rule, contract term, or reporting standard change during the period?
• Did the patient population, service line, contract scope, or geography shift?
• Is the sample large enough that the pattern isn't an artifact of small numbers?
• Are you comparing like to like — same procedure codes, same payer mix, same time window?

If a legitimate explanation accounts for what you're seeing, better to find that yourself now than in a motion to dismiss two years later. If the pattern survives every reasonable challenge, you have something worth pursuing.

Step 5: Document the analysis so someone else can reproduce it

An analysis nobody can reproduce is an opinion. Package your work so an attorney, a forensic accountant, and eventually DOJ can walk through your steps:

• Data source, URL or system, and date pulled
• Filters, exclusions, and cleaning steps — with reasons
• Formulas or code used
• Baseline source and any adjustments
• Findings stated as calculations, not conclusions: "Provider's 99285 rate was 42% versus a peer median of 15%," not "Provider was upcoding."
• A timeline of what you saw, when, and who you told

Keep this record somewhere outside company systems. Access can disappear the day the relationship changes.

Step 6: Choose your reporting strategy — with counsel, not before it

This is a genuinely consequential decision, and the two options are more different than the original framing suggested.

Internal reporting — compliance officer, ethics hotline, legal — creates a documented record that protects you under § 3730(h) and gives the organization a chance to correct course. It has one significant downside for a prospective relator: it can trigger the public disclosure bar if the company then discloses the conduct in a way that goes public, or if the internal report reaches a channel that qualifies as a public disclosure. It can also start the clock on someone else filing first.

Direct qui tam filing preserves the case's exclusivity, keeps the seal intact, and gives you access to DOJ's investigative machinery through your counsel. The downside is the commitment: once filed, the case is a multi-year process largely outside your control.

Which is right depends on facts an attorney needs to see: the strength of your evidence, whether anyone else may be looking at the same numbers, whether the conduct is ongoing, how the organization typically handles reports, and what your relationship with the employer looks like. This is not a decision to make from a blog post. It is the reason Step 1 comes first.

For a fuller grounding in FCA mechanics, evidence standards, and protection provisions before you have that conversation, the False Claims Act and Whistleblower Protections Training walks through the statute, the pleading and materiality standards, and the practical questions relators face at each stage.

Why This Matters Now

The shift toward data-driven qui tam cases is not a passing trend. Four durable changes are driving it, and each is accelerating.

Public data has expanded dramatically. The Medicare provider payment files that were legally sealed until 2014 are now updated annually. Federal contract awards, grant spending, cost reports, and payments to physicians are all published. A motivated analyst can now do serious fraud detection on a laptop using nothing confidential.

The analytical tools reached a floor. Percentile ranks, outlier detection, and pattern analysis that once required a statistician are now spreadsheet-native. AI-assisted analysis is lowering the bar further. What used to be a specialist skill is now a weekend project.

The recoveries are historic. Cumulative FCA recoveries since the 1986 amendments have exceeded $85 billion, with relator awards approaching $10 billion. FY 2025 alone produced $6.8 billion in settlements and judgments and 1,297 new qui tam filings — the most in the statute's history. This attracts specialist counsel, specialist investigators, and specialist relators.

The evidence bar has risen. Rule 9(b) demands particularity. Escobar demands materiality. SuperValu focused scienter on what the defendant actually believed. Each of these makes it harder to plead and win an FCA case on testimony alone — and each makes quantitative, systematic evidence more valuable.

The composite effect is a category of case that barely existed twenty years ago: brought by someone with domain expertise and a spreadsheet, filed on a foundation of numbers that speak for themselves, and prosecuted with the government's resources behind it.

If you have seen something

Three things, in order:

1. Don't act on suspicion alone. Test it against data you can lawfully access. The analytical work is the difference between a hunch and a case.
2. Don't touch internal files before you talk to counsel. The consultation is free and confidential. The mistake it prevents is not.
3. Don't wait. First-to-file is a real rule, and someone else may be looking at the same numbers. If your analysis holds up, move.

The spreadsheet does not replace judgment, insider knowledge, or courage. It supplies what previous generations of whistleblowers didn't have: an objective foundation that speaks before you do, and keeps speaking after your testimony has been challenged.