Subpoena, CID, a Reimaged Laptop, and a CEO Who Wants to Call the FBI

Preserve, immediately and in writing. Issue a litigation hold to all custodians likely to hold relevant records - intake, scheduling, billing, the intake manager, her supervisor, and IT - covering email, text, Teams, voicemail, spreadsheets, and paper. Specifically suspend the Friday reimaging and preserve the laptop, its local files, and the associated network home drive. Pull EHR and billing-system audit logs for the 30 patients and for all copay adjustments in the look-back period. Preservation failures are the fastest way to convert a civil matter into an obstruction issue.

Engage outside counsel today. Route the internal investigation through counsel so that witness interviews, memoranda, and analysis can be assessed for privilege. Note that routine compliance audits conducted in the ordinary course are generally not privileged; do not assume the label protects the underlying facts.

Control communications. Designate one point of contact with the government - outside counsel - and instruct employees not to communicate with agents or to discuss the matter internally. The CEO must not call the FBI. Volunteering information outside counsel's channel, before the agency knows what it is looking at, is not 'getting ahead of it'; it is an unrecorded, uncounseled statement that will be compared against later interviews.

Notify the board and audit committee in writing within 48 hours, with the preservation steps taken and the investigation plan.

What must not happen: no deletions, no 'cleanup' of the copay ledger, no pre-interview of the intake manager by her supervisor, no premature discipline before facts are established, and no public statement to staff beyond the preservation instruction.

Scope. Two workstreams: (1) a targeted review of the specific allegation - the 30 named patients, copay adjustments, gift card purchases, and any patient complaints; (2) an analytics review to determine whether the pattern is broader - compare each intake employee's copay-waiver rate and charitable-adjustment rate against peers, and test for clustering around specific referral sources or the sister's referral coordinator role. Do the data work before the interviews; it tells you what to ask.

Sequencing. Documents, then peripheral witnesses (front-line intake staff, the supervisor, the gift card vendor contact, patients as appropriate), then the referral coordinator, and the intake manager last. Interviewing the subject first locks you into a story before you have the facts.

Protections. Use Upjohn warnings for all employees: the interview is conducted by counsel, the organization - not the employee - holds the privilege, the employee should not discuss the interview with others, and the employee may have personal counsel. Document each interview contemporaneously and consistently.

The intake manager. Do not interview her until counsel has the data analysis and has decided on privilege strategy and whether to offer her counsel or a cooperation framework. Do not terminate her before the investigation concludes unless independent grounds exist; premature termination looks like scapegoating and can look like retaliation if she has raised protected concerns.

The sister. Treat the referral relationship as a conflict-of-interest and possible kickback fact, not merely a family matter. Review whether her referrals were steered to patients who then received waived copays, and whether a related-party disclosure was ever completed.

Quantify before deciding. Convert the allegation into dollars: the copay amounts waived, the gift card value, and the associated claims. If the waiver was routine and not based on individualized financial hardship, the exposure is not just the copay - it is the potential argument that the claims were tainted, plus beneficiary-inducement civil monetary penalty exposure for the gift cards.

Disclosure factors. Favoring self-disclosure through the OIG Self-Disclosure Protocol: a clear pattern, a possible kickback characterization, a hotline report that could become a relator action, and the fact that a government subpoena is already open. Against: the government is already looking, so the credit for self-disclosure is reduced, and any disclosure must be complete and accurate - an incomplete disclosure is worse than none. The middle path is full cooperation with the open investigation plus a proactive, quantified remediation and repayment, reserving the disclosure decision until the facts are established. That is a board-level decision made with counsel.

Overpayment clock. Once the internal investigation establishes a credible quantification, the 60-day overpayment obligation runs; the investigation period must be reasonable and documented.

A credible CAP names root cause (uncontrolled ability to adjust copays without secondary approval; no conflict-of-interest disclosure), specific controls (dual authorization for any copay adjustment, system hard-stops, monthly exception reporting, gift card prohibition with a gift-and-gratuity policy), named owners, testing methodology with sample sizes, measurable exit criteria, discipline consistent with policy across all levels, and a board reporting cadence with minutes. Governments discount plans that are only training. Attach the testing results to the first quarterly report so the plan has evidence behind it, not just commitments.