Health Net Federal Services (HNFS) and parent Centene Corporation agreed to pay $11,253,400 on February 18, 2025 to resolve allegations that HNFS falsely certified compliance with cybersecurity requirements under its TRICARE administration contract with the Defense Health Agency. Per the DOJ press release, Bloomberg Law, and Rivkin Rounds.
The certification trap
Between 2015 and 2018, HNFS failed to meet certain cybersecurity controls and falsely certified compliance with them in annual reports to DHA. Specific failures: HNFS didn't timely scan for known vulnerabilities and didn't remedy security flaws in line with its own System Security Plan and the response times HNFS had established.
The "no breach" framing matters
DOJ explicitly noted no allegation of exfiltration or loss of protected health information or service-member data. The FCA hook is the misrepresentation in the certification — not any underlying compromise. This is exactly the theory DAAG Brenna Jenny later articulated: cyber-FCA cases are "not about data breaches" but "premised on misrepresentations."
Healthcare federal contractors — pay attention
- HIPAA + cybersecurity contract clauses overlap but don't substitute for one another
- FedRAMP-required services must hold authorizations at the contracted impact level — gaps are FCA exposure
- Subcontractor downstream certifications are part of your FCA risk surface
What to do
- Map every cybersecurity attestation against the actual control implementation — close gaps before recompete
- Disclose proactively under DOJ's voluntary self-disclosure framework when warranted
- Embed quarterly third-party audits to keep certifications honest
