A federal envelope lands on a healthcare company's desk, or two agents appear at an executive's door with a grand jury subpoena. The instinct is to read it as a verdict. It is not. It is the opening move in a process that can run for months or years, and the recipient's earliest choices, often made in the first forty-eight hours and before anyone has spoken to a prosecutor, shape everything that follows. The single most useful thing a recipient can do is slow down long enough to answer a narrow question: what exactly is this document, who sent it, and what does it tell me about the road ahead.
This piece walks through that road. It explains how to read the instrument you received, what your status in the investigation means, how far a grand jury can reach, why a civil demand is not ordinary discovery, why the duty to preserve documents attaches the moment an investigation is foreseeable, who actually holds the privilege when company lawyers start asking questions, and why the two most painful consequences for a provider, a payment suspension and an individual indictment, can arrive on tracks that run in parallel. None of it substitutes for counsel engaged on the specific facts. All of it is meant to make the first conversation with counsel a faster and better one.
What kind of request is this, and who sent it
The instrument is the tell. Before anything else, identify which of these arrived, because each signals a different enforcement track, a different set of deadlines, and a different range of exposure. The table below is the quick reference; the sections that follow explain what each track means for your defense.
| Instrument | What it is | What it usually signals |
|---|---|---|
| Grand jury subpoena | Compels documents or testimony before a grand jury (Fed. R. Crim. P. 17) | An open criminal investigation |
| Civil investigative demand (CID) | Compels documents, written answers, or testimony in a False Claims Act investigation before the government files its own civil action or elects whether to intervene in a qui tam case (31 U.S.C. § 3733(a)(1)) | A civil FCA track, which can run parallel to a criminal inquiry |
| Search warrant | Authorizes a seizure on a judge's probable-cause finding (Fed. R. Crim. P. 41) | Judicial authorization for the specified search or seizure; it does not establish the investigation's stage or prove guilt |
| HHS-OIG or FBI interview request | A request to speak, voluntary | Investigative interest, and a moment that can help or harm the record |
| Target or subject letter | A Justice Department notice of the recipient's status | Target means a putative defendant; subject means conduct within the grand jury's scope |
| Medicare or state Medicaid payment-suspension notice | Suspends program payments on a credible fraud allegation (42 C.F.R. § 405.371; § 455.23) | An administrative track that can interrupt cash flow before any charge |
| Exclusion or revocation notice | Bars federal program billing (exclusion) or ends Medicare enrollment (revocation) | An administrative consequence that can move faster than the criminal case |
One category the table cannot capture in a phrase is the administrative subpoena, which signals an agency investigation that has not (yet) become a grand jury matter. In healthcare cases these come in two common forms. The first is a subpoena under 18 U.S.C. § 3486, which the Attorney General or a designee may issue in the investigation of a "Federal health care offense" to compel records and custodian testimony without a grand jury. The second is an HHS-OIG subpoena under the Inspector General Act, whose subpoena authority was historically cited to 5 U.S.C. App. § 6(a)(4) and now sits at 5 U.S.C. § 406(a)(4) after the 2022 reorganization of the Act.
The same conduct can draw more than one of these at once, and often does. A marketing arrangement questioned as a kickback can generate a grand jury subpoena to the company, a CID to a billing vendor, and an OIG payment suspension against the provider, in the same quarter. Reading the instrument correctly is the first act of defense, because it tells you which clock is running.
How long do I have to respond
Ask how long you have to respond, and the honest answer is that there is no universal deadline. The clock is set by the specific instrument, and several run short. Confirm each one against the document you actually received and the current statute or rule, because more than one clock can be running at the same time.
- A CID states its own production date on its face. Separately, a recipient who wants to challenge the demand may petition the court to modify or set it aside within 20 days after service, or before the return date, whichever is earlier (31 U.S.C. § 3733(j)(2)(A)). The statute also allows a later challenge date prescribed in writing by the investigator, so confirm any extension rather than assuming it changes every obligation.
- A grand jury subpoena is due on its return date. Rule 17(c)(2) permits a court, on a prompt motion, to quash or modify an unreasonable or oppressive document subpoena, and any challenge should be raised before compliance is due.
- A search warrant has no response deadline, but the moment of execution changes everything about preservation and posture, and Rule 41(g) allows a later motion for return of property.
- A CMS payment suspension generally carries an opportunity to submit a rebuttal statement, under procedures that turn on whether prior notice was given. Section 405.374 generally allows at least 15 days after notification, with a shorter or longer period for cause, and suspensions based on a credible allegation of fraud are excepted from the ordinary duration cap under § 405.372(d).
- A revocation or exclusion notice can trigger separate review deadlines, sometimes measured from receipt rather than the date printed on the notice. Confirm the reconsideration and hearing windows against the current rule before relying on any figure.
The practical point is simple. Read the instrument for its own date, then check the governing rule for any separate motion or appeal deadline, because those are two different clocks and both can lapse quickly.
Target, subject, or witness
Where you sit in the investigation matters as much as the document that reached you. The Justice Manual sorts everyone the grand jury touches into three categories (JM 9-11.151), and the labels carry real consequences.
A target is a person the prosecutor already regards as a putative defendant, someone against whom the grand jury has substantial evidence linking them to a crime. Counsel for a target proceeds on the assumption that an indictment is contemplated, and the Fifth Amendment analysis for an individual target is front and center.
A subject is a person whose conduct is within the scope of the grand jury's investigation but who is not yet a putative defendant. A subject is not in the clear; status is fluid and can move in either direction as the facts develop.
A witness is everyone else with relevant information. Even a witness can convert to a subject or target quickly by mishandling the request, most dangerously through a false statement or the destruction of documents.
Two practical points follow. First, an officer or employee of a company under investigation does not automatically become a target just because the company is one; the government assesses individual exposure individually, which is why an entity and its people frequently need separate counsel. Second, the government is not required to tell anyone they are a target, and often will not, so do not infer safety from silence. Ask the prosecutor directly what your status is. A refusal to say is itself information.
How far a grand jury subpoena reaches
Recipients often assume an overbroad subpoena is easy to fight. The law runs the other way. In United States v. R. Enterprises, Inc., 498 U.S. 292 (1991), the Supreme Court held that a grand jury subpoena issued through normal channels is "presumed to be reasonable," and that "the burden of showing unreasonableness must be on the recipient who seeks to avoid compliance" (498 U.S. at 301). The Court rejected the idea that the demanding trial-subpoena standard of United States v. Nixon (relevancy, admissibility, specificity) governs grand jury subpoenas at all (498 U.S. at 298-99). A motion to quash under Rule 17(c) will be denied unless the district court finds "no reasonable possibility that the category of materials the Government seeks will produce information relevant to the general subject of the grand jury's investigation" (498 U.S. at 301).
That is a hard standard for a recipient to meet, and it exists because the grand jury's investigative power is deliberately broad. It "can investigate merely on suspicion that the law is being violated, or even just because it wants assurance that it is not," and it needs no showing of probable cause to issue a subpoena. The realistic path is rarely a facial motion to quash. It is a negotiation with the prosecutor over scope, custodians, date ranges, and a production schedule, backed by the credible ability to litigate genuine overbreadth or undue burden if the negotiation fails.
The Fifth Amendment for a person, and for a company
When a subpoena demands documents, a second question appears: can the recipient resist on the ground that producing the documents would itself be incriminating? Here the law draws a sharp line between an individual and an entity, and the line drives who should be served and how to respond.
For an individual, the act of producing documents can carry its own Fifth Amendment protection. In United States v. Hubbell, 530 U.S. 27 (2000), the Court explained that producing documents in response to a subpoena has a "compelled testimonial aspect," because by producing them the person admits "that the papers existed, were in his possession or control, and were authentic" (530 U.S. at 36). Where the government compelled that act under a grant of immunity, it could not then build a prosecution out of the documents the act identified, and the resulting indictment was tainted (530 U.S. at 40-43). For an individual served in a personal capacity, the act-of-production privilege is real and sometimes decisive.
For a company, and for the custodian of its records, that privilege disappears. Under the collective-entity rule, a corporation has no Fifth Amendment privilege, and Braswell v. United States, 487 U.S. 99 (1988), holds that a custodian cannot resist a subpoena for corporate records by claiming that producing them would incriminate him personally. The custodian's act of production "is not deemed a personal act, but rather an act of the corporation" (487 U.S. at 118). There is one meaningful limit that defense counsel should hold onto: because the act is the corporation's, the government may not use the individual's act of production against the custodian personally, and may not tell the jury that he was the one who produced the records (487 U.S. at 118 and n.11).
The practical upshot is that the form of the subpoena matters enormously. A subpoena to the company for corporate records will be answered by a custodian who cannot invoke the act-of-production privilege; a subpoena to an individual for personal materials is a different problem with different defenses. An executive who receives a subpoena should determine, before producing a single page, whether it runs to the company or to the person.
The civil investigative demand is not ordinary discovery
The most common and costly error with a CID is treating it like a civil discovery request that can be met with a leisurely meet-and-confer. It cannot. As the deadline section above notes, the window to petition to modify or set aside a CID is short (31 U.S.C. § 3733(j)(2)(A)), and once it lapses the objections to scope and burden on the face of the demand are much harder to raise. The bigger problem is what the demand is for.
Three features of the CID deserve particular attention. First, it is a pre-suit tool that reaches "any person," which extends well beyond the targets of the investigation, so vendors, billing companies, and former employees can all be served. Second, its oral-testimony component is a sworn examination that resembles a deposition taken before any lawsuit exists, and answers given there can be used later. Third, and most important for strategy, § 3733 permits the government to share CID material with a qui tam relator in appropriate circumstances, so a company should assume that what it produces may reach the whistleblower's counsel who prompted the investigation. Privilege logging and the scope of production should be handled with that reader in mind.
Preserve first: the litigation hold and the shadow of obstruction
The moment a government request arrives, and often earlier, when an investigation becomes reasonably foreseeable, a duty to preserve documents attaches and every routine deletion practice must stop. Getting this wrong turns a manageable document problem into a felony.
The cautionary tale is Arthur Andersen LLP v. United States, 544 U.S. 696 (2005). As Enron collapsed in 2001, its auditor invoked a "document retention policy" and destroyed records. The opinion's own timeline is the lesson. An in-house lawyer's notes recorded that an SEC investigation was "highly probable." A partner urged staff to comply with the retention policy, adding that "if it's destroyed in the course of normal policy and litigation is filed the next day, that's great." Then, after the subpoenas landed, came the email that reads like an epitaph, "Per Dave, No more shredding. We have been officially served for our documents" (544 U.S. at 699-702). The Supreme Court reversed Andersen's obstruction conviction, but on a narrow ground about faulty jury instructions, holding that a conviction under 18 U.S.C. § 1512(b) requires "consciousness of wrongdoing" and a nexus to a particular proceeding the persuader had "in contemplation" (544 U.S. at 706-08).
Read Andersen correctly and it is not permission to shred. It is the opposite. The two elements the Court found missing, a culpable state of mind and a proceeding in contemplation, are exactly what a subpoena, a CID, or a notice of investigation supplies. Once a proceeding is foreseen, destroying responsive documents furnishes the nexus and the intent, and the conduct becomes chargeable. Congress drove the point home after Andersen by enacting 18 U.S.C. § 1519, which criminalizes destroying or falsifying records "in relation to or contemplation of" any federal matter and requires no pending or particular proceeding at all. A parallel provision, 18 U.S.C. § 1512(c), reaches the corrupt destruction of records for use in an official proceeding. Post-subpoena destruction is treated by prosecutors as serious, chargeable obstruction and as vivid evidence of a guilty mind, and it destroys any hope of cooperation credit.
The response is not complicated, but it must be immediate: issue a written litigation hold, suspend auto-deletion and routine document purges, preserve email and messaging applications and structured data, and instruct custodians in writing not to delete anything. The cost of over-preserving is trivial next to the cost of a single deleted file.
Who represents whom: the internal investigation and the privilege
Almost every serious matter begins with an internal investigation, usually company counsel interviewing employees to learn what happened. Those interviews are privileged, but a crucial question is whose privilege it is. Upjohn Co. v. United States, 449 U.S. 383 (1981), answers it. The company had run exactly this kind of internal investigation into possible illegal payments by a foreign subsidiary, and when the IRS demanded the investigation files, the Court held the attorney-client privilege protected counsel's communications with employees at every level, not merely a senior "control group," because middle- and lower-level employees "can, by actions within the scope of their employment, embroil the corporation in serious legal difficulties" and often hold the facts counsel needs (449 U.S. at 391-95). The Court also gave counsel's interview notes strong work-product protection (449 U.S. at 399-402).
The privilege that Upjohn protects belongs to the company, not to the employee being interviewed. That is the origin of the "Upjohn warning," the corporate version of a Miranda warning that counsel must give at the start of an employee interview: I represent the company, not you; this conversation is privileged, but the privilege is the company's, and the company alone can decide to waive it and hand your statements to the government. An executive who assumes that the company's lawyers are also their lawyers is making a dangerous mistake, and it is one reason individual officers often need their own counsel early. The conflict is not theoretical, as the cooperation rules below make plain.
Assume the civil and criminal tracks are talking
The government may pursue civil and criminal proceedings over the same conduct at the same time, and it coordinates across them by policy (Justice Manual 1-12.000). The foundational decision is United States v. Kordel, 397 U.S. 1 (1970), which held that the government need not choose between a civil and a criminal case or defer one for the other, and that a corporate officer's answers in civil discovery could be used against him in the later criminal prosecution because he had not asserted his Fifth Amendment privilege when he gave them (397 U.S. at 7-11). Kordel teaches three things a recipient should carry into every parallel-proceedings situation.
First, the privilege must be affirmatively and timely invoked. An officer "is not barred from asserting his privilege simply because the corporation had no privilege of its own, or because the proceeding was civil rather than criminal in character" (397 U.S. at 8), but silence forfeits it. A "failure at any time to assert the constitutional privilege leaves him in no position to complain now that he was compelled to give testimony against himself" (397 U.S. at 10).
Second, there is a defensive move. Where no corporate agent can answer civil discovery without a "real and appreciable" risk of self-incrimination, the "appropriate remedy would be a protective order under Rule 30(b), postponing civil discovery until termination of the criminal action" (397 U.S. at 8-9). A stay of the civil case is the tool for protecting the Fifth Amendment interests of individuals while a criminal matter is live, though the standard is demanding. The False Claims Act contains its own version of this lever running the other way. Under 31 U.S.C. § 3730(c)(4), the government can ask the court to stay civil discovery when it would interfere with a parallel criminal or civil investigation, so the stay can be a sword for the government as readily as a shield for the defense.
Third, coordination has an outer limit the recipient can invoke. Kordel expressly reserved, as different, a case "where the Government has brought a civil action solely to obtain evidence for its criminal prosecution or has failed to advise the defendant in its civil proceeding that it contemplates his criminal prosecution" (397 U.S. at 11-12). If the government uses civil process in bad faith as a stalking horse for the grand jury, or affirmatively misleads a party about a criminal investigation, that is a line the courts police. Watch for the tell that a criminal case is running behind a civil-looking request, and preserve the argument.
Cooperation, and the price of it
Early in a matter a company must decide how to posture toward the government, and three frameworks shape what that posture earns. Under the False Claims Act cooperation guidelines (Justice Manual 4-4.112), the Department credits timely voluntary self-disclosure and genuine cooperation, usually by reducing the damages multiplier and penalties it seeks, though never below full compensation for the government's losses plus its costs and any relator's share. Cooperation buys down the multiple, not the single damages.
The credit comes with a condition that reaches the individual. Under DOJ's individual-accountability policy (Justice Manual 9-28.210, rooted in the 2015 "Yates Memo"), a company generally must identify the individuals involved in the misconduct and provide the relevant facts about their conduct to be eligible for cooperation credit. That requirement is precisely where the company's interests and its executives' interests can diverge, and it turns the Upjohn privilege point above into a live conflict question about who controls the privilege and who needs separate counsel.
For a provider that discovers its own problem, the HHS-OIG Health Care Fraud Self-Disclosure Protocol offers a defined path to resolve potential violations, including Anti-Kickback Statute conduct. It carries real benefits, including a general minimum settlement multiplier of 1.5 times single damages (well below what litigation risks) and a stated presumption against imposing integrity-agreement obligations. It also carries floors: OIG has set a minimum settlement of $100,000 for kickback-related disclosures and $20,000 for others, and disclosing parties "should expect to pay above single damages." Self-disclosure is a serious, time-sensitive decision that interacts with the 60-day overpayment refund rule (42 U.S.C. § 1320a-7k(d)), and it should follow, not precede, a defensible internal investigation.
The consequence providers forget: a payment suspension
For a healthcare provider, the fastest and most punishing blow is often not a charge but a cash-flow event. Under 42 C.F.R. §§ 405.370 through 405.372, the Centers for Medicare & Medicaid Services or a Medicare contractor may suspend Medicare payments, in whole or in part, on a "credible allegation of fraud," defined as an allegation from any source that carries "indicia of reliability." The bar is low by design, well below any finding of liability, and the suspension can hit pending and future claims at once, so a provider that depends on Medicare receivables can face a liquidity crisis within a single billing cycle while it is still presumed innocent.
Ordinarily a provider gets prior notice and a chance to submit a rebuttal, but the regulation lets CMS forgo prior notice where the suspension rests on credible allegations of fraud. A fraud-based suspension is generally capped at 180 days with a possible 180-day extension, but that cap does not apply once the matter is referred to and being considered by OIG or DOJ, so a suspension can persist for the life of the investigation. The rebuttal will not lift the suspension, but it should be filed anyway and filed fast: it builds the record, can persuade CMS to narrow a full suspension to a partial one, and must be coordinated with the criminal and civil defense, because what is argued to CMS can surface elsewhere.
State Medicaid runs a parallel mechanism, so a provider can face suspension on both fronts at once (42 C.F.R. § 455.23). Two related administrative consequences move on their own tracks and can outrun the criminal case. Exclusion bars a provider from billing federal programs at all, and revocation ends Medicare enrollment. Each carries its own notice, effective date, and appeal window, often measured from receipt rather than the date on the notice, and each demands a response that is coordinated with, but separate from, the criminal and civil defense.
The first days: a short practical checklist
- Identify the instrument and the sender, and from them the track: grand jury (criminal), CID (civil FCA, likely a sealed qui tam), or administrative subpoena (agency).
- Engage experienced counsel immediately, and separately assess whether individual officers need their own lawyers.
- Issue a written litigation hold and stop every routine deletion practice the same day.
- Docket every deadline, including the CID's short petition window, on day one.
- Learn your status if you can. Ask the prosecutor whether the client is a target, subject, or witness.
- Do not let employees speak to agents unprepared, and make sure every internal interview begins with an Upjohn warning.
- For a provider, model the payment-suspension risk now, and plan financing before a suspension arrives.
- Say nothing to the government, and destroy nothing, until counsel has mapped the terrain.
How Fridman Fels & Soto helps
Our white-collar and healthcare-fraud practice defends companies and executives through exactly these moments, from the first subpoena or CID to resolution or trial. Members of the team have served at the Department of Justice, including as Special Counsel for Health Care Fraud and as Senior Counsel to the Deputy Attorney General, and that vantage point on how the government builds and coordinates these investigations informs how we defend them. Our Federal Health Care Fraud Defense Report develops the parallel-proceedings framework in greater depth, including sentencing and program-consequence exposure. If a government request has arrived, or you think one may be coming, the most valuable conversation is an early one.
Sources and further reading
- Civil investigative demands: 31 U.S.C. § 3733
- Government stay of False Claims Act discovery: 31 U.S.C. § 3730(c)(4)
- Grand jury subpoenas: Fed. R. Crim. P. 17
- Medicare payment suspension and rebuttal procedures: 42 C.F.R. §§ 405.372, 405.374
- Medicaid payment suspension: 42 C.F.R. § 455.23
- Obstruction and record destruction: 18 U.S.C. §§ 1519, 1512
Frequently Asked Questions
What should I do first if my company receives a grand jury subpoena or civil investigative demand?
Stop, preserve, and call experienced counsel before you respond or speak to anyone from the government. Identify what you received. A grand jury subpoena signals a criminal investigation, while a civil investigative demand (CID) signals a civil False Claims Act inquiry that often runs alongside a sealed whistleblower complaint. Issue a written litigation hold immediately and suspend any routine document deletion, because destroying records after a request can be a separate felony. Do not assume the request is a verdict; it is the start of a process whose outcome your early choices strongly influence.
Is a civil investigative demand just like a normal civil subpoena?
No, and treating it that way is a costly mistake. A CID under 31 U.S.C. § 3733 is a pre-lawsuit tool that can compel documents, written interrogatory answers, and sworn oral testimony resembling a deposition, all before any complaint is filed. The deadline to challenge it in court is short (the statute sets a 20-day window from service, or the return date if sooner), so objections have to be raised fast. Assume that what you produce may be shared with the whistleblower whose complaint prompted the investigation, and handle privilege and scope accordingly.
Can I refuse to hand over documents by invoking the Fifth Amendment?
It depends on whether the documents are yours personally or the company's. An individual served in a personal capacity may have an "act of production" privilege, because producing documents can itself be testimonial by admitting they exist, are authentic, and were in your control (*United States v. Hubbell*, 530 U.S. 27 (2000)). A company has no Fifth Amendment privilege, and the custodian of corporate records cannot refuse to produce them on personal self-incrimination grounds (*Braswell v. United States*, 487 U.S. 99 (1988)). Because the answer turns on the form of the subpoena and your capacity, determine that with counsel before producing anything.
If company lawyers interview me during an internal investigation, are they my lawyers?
No. When company counsel interviews employees, the conversation is privileged, but the privilege belongs to the company, not to you (*Upjohn Co. v. United States*, 449 U.S. 383 (1981)). The company can decide to waive that privilege and share your statements with the government. That is why counsel should give an "Upjohn warning" at the start of the interview, making clear they represent the company, and why an individual officer whose interests may diverge from the company's often needs separate counsel early.
Can the government pursue a civil case and a criminal case against me at the same time?
Yes. The government may run parallel civil and criminal proceedings over the same conduct and coordinate between them (*United States v. Kordel*, 397 U.S. 1 (1970)). What you say or produce in the civil matter can be used in the criminal one, and the Fifth Amendment privilege is waived if you do not affirmatively and timely assert it. Where answering civil discovery would risk self-incrimination, counsel can seek a protective order or stay of the civil case. There are limits. The government may not bring a civil action solely to gather evidence for a criminal case or affirmatively mislead you about a criminal investigation.
My company is on Medicare. Can the government cut off our payments before proving anything?
Yes, and this is often the most immediate financial threat. Under 42 C.F.R. §§ 405.370 through 405.372, CMS or a Medicare contractor may suspend payments on a "credible allegation of fraud," a low standard that requires only "indicia of reliability" and no finding of wrongdoing. The suspension can reach pending and future claims and can persist for the length of the investigation once OIG or DOJ is involved. File a rebuttal quickly even though it will not lift the suspension, model the cash-flow impact immediately, and coordinate the response with your criminal and civil defense.
