A subpoena from a state Medicaid Fraud Control Unit (MFCU) is not a records request from a Medicaid audit contractor, and treating it like one is the fastest way to turn a document production into an admission. MFCUs sit inside the state Attorney General's office in nearly every state, and federal rules require them to investigate both Medicaid provider fraud and patient abuse or neglect, so the same unit issuing the subpoena can also be building a criminal case. How a provider handles scope, privilege, and what gets said to the investigator all become part of the record the unit builds.
Negotiating The Scope Before Producing Anything
An MFCU subpoena is frequently broader than the facts justify, listing years of records, every payer's claims rather than Medicaid's, or every provider at a practice rather than the one under review. A subpoena's scope is negotiable before the response deadline, not after production. Counsel can contact the assigned investigator or the unit's attorney to request a narrowed date range, a defined universe of patient records tied to specific claims, or additional time to comply where the volume is genuinely unworkable. Producing more than the subpoena actually requires, out of an instinct to appear cooperative, gives the unit material it was never entitled to ask for and cannot easily be taken back once handed over.
Privilege Review Before A Single Document Goes Out
Every document responsive to an MFCU subpoena needs a privilege review before production, not a skim. Attorney-client privilege covers communications with counsel, including in-house compliance counsel, made for the purpose of obtaining legal advice. The work product doctrine separately protects material prepared in anticipation of litigation or investigation, which can include an internal self-audit commissioned after the practice learned of a billing problem. Compliance memos, internal investigation notes, and communications with outside counsel are the categories most often produced by mistake because they sit in the same email account or shared drive as ordinary business records. Where privilege is claimed, the responding party logs what it withheld, rather than silently omitting it, so the claim can be tested rather than assumed waived.
An MFCU subpoena investigates both civil Medicaid fraud and criminal patient abuse or neglect, and the same investigator's file can support either one, which makes the response itself part of the record prosecutors will later read.
The Parallel Criminal Risk A Civil Audit Does Not Carry
A payer-side audit resolves in recoupment and, where the provider disagrees with the finding, an audit appeal. An MFCU investigation carries that same civil exposure, including state false-claims liability analogous to the federal False Claims Act, and it can also carry criminal exposure the audit process never touches. Federal certification requirements direct MFCUs to investigate and, where warranted, prosecute both Medicaid provider fraud and abuse or neglect of Medicaid beneficiaries in health care and board-and-care facilities, so the same unit that requested billing records for a civil overpayment theory can be developing a criminal referral off the same documents. A provider who has already been excluded or is at risk of OIG exclusion is often already known to the unit before the subpoena is issued. Multiagency coordination between an MFCU, HHS-OIG, the FBI and the U.S. Attorney's Office is common on the larger matters, which is why an MFCU subpoena is read as a criminal-exposure event first and a records request second.
What Not To Do When The Subpoena Arrives
Investigators sometimes tell a provider the subpoena is routine, that the practice is not the target, or that counsel is unnecessary. None of that changes what the subpoena legally requires. Do not call the investigator to "explain" the billing pattern before counsel has reviewed the file. Do not produce more than the subpoena's stated scope to look cooperative. Do not assume records already produced to a payment suspension proceeding satisfy the MFCU's separate request; the two run on different tracks, and conflating them can create inconsistent statements a prosecutor later compares line by line.
Why Early Legal Counsel Is Critical
It is critical that healthcare providers promptly retain experienced healthcare defense counsel upon receiving an MFCU subpoena, audit notice, investigative request, or other government inquiry. Early legal intervention can protect the provider's rights, ensure appropriate responses to government requests, avoid inadvertent admissions, preserve relevant defenses, and allow counsel to communicate with investigators on the provider's behalf. Delaying legal representation can significantly affect the outcome of a matter and expose the provider to unnecessary risk.
How Health Law Alliance Can Help
Health Law Alliance has represented 2,500+ clients over 25+ years, including providers served with MFCU subpoenas that carry both civil and criminal exposure. Our Medicaid audit defense attorneys negotiate subpoena scope, run privilege review before a single document is produced, and represent providers through both the civil and criminal tracks an MFCU matter can open. Contact Health Law Alliance for a free, confidential consultation.
