On June 23, 2026, the U.S. Department of Justice (DOJ) and Department of Health and Human Services (HHS) announced the results of the 2026 National Health Care Fraud Takedown, charging 455 defendants in alleged schemes involving more than $6.5 billion in false claims. The announcement is notable not only for its size, but for what it says about the maturation of health care fraud enforcement. DOJ has been talking about data analytics and whole-of-government coordination for years. This year’s Takedown suggests those concepts are no longer just aspirational talking points – they are increasingly the operating model, with data used earlier and more aggressively, familiar priorities like opioids joined by fast-emerging targets like allografts and skin grafts, and DOJ’s new National Fraud Enforcement Division (NFED) positioned as a coordinating hub.
The Numbers: Smaller Than 2025, Still…
IT & DATA SECURITY (MITIGATING THE “INSIDER THREAT”)
As seen in the TD Bank case, an employee with too much “access” can sell your customer data to syndicates.
- Principle of Least Privilege (PoLP): Employees should only have access to the specific folders and databases required for their current task.
- Access Revocation: Have a “Termination Checklist” that ensures all digital access (Email, VPN, Banking) is revoked within 60 minutes of an employee resigning or being dismissed.
- System Logs & Audit Trails: Enable “Read/Write Logging” on your server. If a customer’s data is leaked, you need to know exactly which login accessed that record and at what time.
- Encryption at Rest: Ensure that sensitive files (like your customer ID numbers or payroll spreadsheets) are encrypted so that if a staff member copies them to a USB, they cannot be read.