Table of Contents
Ready to See Results?
From strategy through execution, Atlantic Health Strategies integrates compliance, operations, and growth into durable, measurable results. Let’s put our expertise to work for your organization.
The Acuity TMS verdict and what BH operators should take from it
Behavioral health clinic owners reduce criminal exposure to DOJ and TRICARE fraud charges by pairing an OIG-aligned compliance program with independent claims audits, tight medical-necessity documentation, and written vendor and marketing controls that address the Anti-Kickback Statute (42 U.S.C. § 1320a-7b) and the Eliminating Kickbacks in Recovery Act (18 U.S.C. § 220). The Kevin Curry case out of the Northern District of Texas is the reason this is not theoretical.
On September 25, 2026, the U.S. Department of Justice announced that a federal jury in Fort Worth convicted Kevin D. Curry, 64, of Frisco, Texas, on nine felony counts tied to a scheme to defraud TRICARE. Curry was the owner and operator of Acuity TMS of Plano LLC, Acuity TMS of Fort Worth LLC, and Emerald Coast TMS of Fort Walton Beach LLC. Prosecutors proved that he offered and paid over $5.5 million in kickbacks to convince active-duty servicemembers, veterans, and their family members to consent to TMS therapy they did not qualify for and, in many instances, did not receive.
Read the DOJ press release carefully, because the operator-side failures are named. Curry, who falsely held himself out to be a medical doctor, used actual doctors’ credentials without their knowledge and consent to bill TRICARE as part of the scheme. In an effort to conceal his fraud, Curry directed employees to fabricate medical records that he submitted to TRICARE to justify his fraudulent billings. Acuity billed TRICARE over $26 million in false, fraudulent, and kickback-tainted TMS claims, based on which TRICARE paid approximately $17 million.
Every failure named in that indictment maps to a control an operator can build today: credentialing verification, marketing and referral source auditing, medical-necessity attestation, and independent chart review before claims go out the door.
TRICARE program integrity is not Medicare with a different logo
Behavioral health operators who bill TRICARE frequently assume the program mirrors Medicare enforcement. It does not. The Defense Health Agency (DHA) runs its own Program Integrity office, and the criminal investigative arm is the Defense Criminal Investigative Service (DCIS), which sits inside the DoD Office of Inspector General. In the Curry case, the DOJ release names DCIS, HHS-OIG, the FBI, and the Texas Attorney General’s Medicaid Fraud Control Unit as investigative partners. That is a joint task-force posture, not a routine payer audit.
The consequence for operators is that a TRICARE line item on your revenue cycle brings in a federal criminal investigator alongside the standard civil False Claims Act exposure under 31 U.S.C. §§ 3729–3733. The charging statutes in behavioral health TRICARE cases are almost always the Health Care Fraud statute (18 U.S.C. § 1347), the Anti-Kickback Statute, and money laundering counts under 18 U.S.C. § 1957. The jury convicted Curry of three counts of healthcare fraud, three counts of offering and paying illegal healthcare kickbacks, and three counts of engaging in monetary transactions in criminally derived property. He is scheduled to be sentenced at a later date and faces a maximum penalty of 10 years in prison on each count.
Operators serving military beneficiaries should treat TRICARE-related medical necessity documentation and referral-source vetting as a higher-risk category than commercial payer work. Not because the ASAM criteria change, but because the investigative reach does.
The scale of federal healthcare fraud enforcement in 2024 and 2025
Behavioral health operators sometimes read a single DOJ press release and assume it was an outlier. The enforcement data does not support that read.
- The HHS Office of Inspector General expects to recoup $7.13 billion in recoveries and receivables in FY 2024 from its investigations and audits, according to its Fall 2024 semiannual report to Congress. Those funds came from 1,548 criminal and civil enforcement actions against individuals and companies suspected of engaging in crimes targeting HHS programs and the people they serve.
- 3,234 individuals were added to the HHS-OIG exclusion list, barring them from participating in federal healthcare programs.
- The 2025 National Health Care Fraud Takedown was the largest Justice Department Health Care Fraud Takedown in history, more than doubling the prior record of $6 billion. The Takedown resulted in criminal charges against 324 defendants, including 96 doctors, nurse practitioners, pharmacists, and other licensed medical professionals, in 50 federal districts and 12 State Attorneys General’s Offices across the United States, for their alleged participation in various health care fraud schemes involving over $14.6 billion in intended loss.
- CMS also announced that it successfully prevented over $4 billion from being paid in response to false and fraudulent claims and that it suspended or revoked the billing privileges of 205 providers in the months leading up to the Takedown.
As HHS Inspector General Christi Grimm put it in the Spring 2024 report, “These enforcement cases often involved egregious fraud, including false billing, costly kickback schemes, and failures to provide care.” That sentence should be read as a description of the DOJ’s active theory of the behavioral health case: false billing, kickbacks, and care that was never delivered. It is the exact theory the Fort Worth jury accepted against Curry.
The operator-side compliance build that would have interrupted the Acuity scheme
The Curry indictment is a checklist of failures that a working compliance program catches. Founders and COOs should stop reading these press releases as morality plays and start reading them as internal audit findings.
Here is what a defensible behavioral health compliance program looks like, aligned to the HHS-OIG General Compliance Program Guidance published in November 2023:
- Written standards and a designated compliance officer with real independence. Not the CFO wearing two hats. The compliance officer needs a direct reporting line to the board or ownership and authority to halt billing.
- Credentialing verification at the source. Every provider NPI billed by your clinic must be tied to a signed attestation from the actual provider, refreshed on a set cadence. The Acuity scheme survived because the Justice Department said Curry used the credentials of actual doctors without their knowledge or permission to submit claims to TRICARE.
- Medical-necessity documentation tied to ASAM Criteria 4th Edition and payer-specific rules. For each level of care your clinic bills, PHP (ASAM Level 2.5), IOP, or otherwise, your clinical notes must independently support the level billed. Utilization review has to be a functioning check, not a rubber stamp.
- Independent pre-bill chart audits. A sample of charts reviewed by someone with no revenue incentive, before claims go out. This is where fabricated documentation gets caught. Fabricated records only survive an audit that never happens.
- EKRA-compliant marketing and referral contracts. Every marketing agreement, patient-brokering vendor, and outreach contractor needs a written EKRA and Anti-Kickback review. Percentage-of-revenue payments to marketers touching federal beneficiaries are a red flag. Cash payments to induce patient enrollment, which is what the DOJ proved at Acuity, are the paradigm case.
- A corrective action plan process with documented follow-through. Auditors do not expect perfection. They expect proof that when you found a problem, you fixed it and can show the fix.
- Self-disclosure protocols. Your compliance officer needs a written playbook for when to run something up to the HHS-OIG Self-Disclosure Protocol or the DOJ. That decision cannot be improvised.
None of this is exotic. All of it is the difference between a corrective action plan and an indictment.
Frequently asked questions
What specific billing practices trigger DOJ scrutiny of behavioral health clinics?
The recurring patterns in DOJ press releases are billing for services not rendered, upcoding levels of care (billing PHP when only IOP was delivered, or billing IOP without meeting weekly hour minimums), medically unnecessary services, kickbacks paid to marketers or patients, and use of provider credentials without the provider’s knowledge. The Curry conviction hits four of those five in a single indictment.
How does TRICARE program integrity differ from Medicare and Medicaid enforcement?
TRICARE is administered by the Defense Health Agency, and the criminal investigative arm on TRICARE cases is the Defense Criminal Investigative Service, part of the DoD OIG. In the Acuity matter, the DOJ press release names DCIS alongside HHS-OIG and the FBI. Expect a joint federal task force, not a single-payer audit, when TRICARE claims are in play.
Does EKRA apply to my BH facility even if I don’t bill federal payers?
Yes. The Eliminating Kickbacks in Recovery Act, 18 U.S.C. § 220, applies to recovery homes, clinical treatment facilities, and clinical labs regardless of the payer, including fully commercial books of business. That is a common misread. Every marketing, call-center, and referral-partner contract at a BH facility should be reviewed against EKRA regardless of whether TRICARE or Medicaid is in the mix.
What are the minimum elements of an OIG-recognized compliance program for a BH clinic?
The HHS-OIG General Compliance Program Guidance issued in November 2023 identifies written policies and procedures, a compliance officer and committee, effective training and education, effective lines of communication including anonymous reporting, enforcement of standards through disciplinary guidelines, internal monitoring and auditing, and prompt response to detected offenses with corrective action. For a BH clinic, monitoring and auditing must include level-of-care documentation, weekly hour verification, and referral-source review.
If I discover a billing error, am I required to self-disclose to DOJ or OIG?
Under the 60-day repayment rule tied to the ACA and False Claims Act, identified overpayments to federal healthcare programs must be reported and returned within 60 days of identification. HHS-OIG maintains a Self-Disclosure Protocol for potential fraud, and DOJ has its own voluntary disclosure framework. Whether to use one, both, or neither is a legal call your compliance counsel makes, but ignoring the finding is not an option. Document the date of identification, quantify the exposure, and get counsel involved that week.
References
- U.S. Department of Justice, Office of Public Affairs, “Texas Mental Health Clinic Owner Convicted in $26M Scheme to Defraud Military Health Benefits Program” (September 25, 2026)
- HHS-OIG, “HHS-OIG’s Efforts Result in $7.13 Billion in Expected Recoveries and Receivables, According to Fall 2024 Semiannual Report”
- HHS-OIG, “HHS-OIG Reports Nearly $3 Billion in Expected Recoveries in Newly Streamlined Semiannual Report” (Spring 2024 SAR)
- CMS, “National Health Care Fraud Takedown Results in 324 Defendants Charged in Connection with Over $14.6 Billion in Alleged Fraud” (2025 Takedown)
- HHS Office of Inspector General, General Compliance Program Guidance (November 2023)
- U.S. Department of Justice, “National Health Care Fraud Takedown Results in 455 Defendants Charged in Connection with Over $6.5 Billion in Alleged Fraud” (2026 Takedown)