Health Net Federal Services and Centene: Annual Certifications, Unresolved Cybersecurity Warnings

In the Health Net Federal Services and Centene cybersecurity settlement, the companies agreed to pay $11,253,400 to resolve allegations that Health Net falsely certified compliance with cybersecurity requirements while administering TRICARE health benefits. The government alleged that annual reports said the required controls were in place while vulnerability scanning, security fixes and responses to audit findings fell short. For someone inside security or internal audit, the important comparison is familiar: what the company reported to its government customer and what its own systems and auditors were telling it.

The Justice Department announced the settlement on February 18, 2025. Health Net Federal Services administered the Defense Health Agency’s TRICARE program for servicemembers and their families under a Defense Department contract. The government’s allegations concerned the cybersecurity promises attached to that administration work.

Annual TRICARE Certifications and Unresolved Findings

Annual TRICARE certifications were the government’s window into Health Net’s compliance with required cybersecurity controls. The government alleged that, between 2015 and 2018, the company failed to meet certain controls while falsely certifying compliance in annual reports to the Defense Health Agency. The settlement agreement identifies NIST SP 800-53 Revision 4 and 51 specified controls as the contractual framework.

That makes the security work part of the service the government bought. A benefits administrator handles sensitive information about servicemembers and their families, and the contract required safeguards for that information. We see the absurdity in that alleged gap: the government was paying for safeguards and getting assurances while the auditors were reporting risks.

Scans and Fixes on the Company’s Own Clock

The government alleged that Health Net failed to scan for known vulnerabilities and remedy security flaws within the required response times. Those timing obligations came from its System Security Plan and response times the company had established.

For an insider, the dates connect the technical problem to the certification. We compare when a scan should have occurred, what it found, when a fix was due and what the annual report said about the same systems. A remediation record has more to say when it can be read against the promise the company made and the deadline it set for itself.

Audit Findings and the Next Certification

The government also alleged that Health Net ignored reports from third-party security auditors and its own internal audit department. Those reports identified risks involving access controls, firewalls, obsolete hardware and software, patches and passwords, among other weaknesses.

Those findings give an insider a way to connect a technical weakness with the company’s knowledge of it: who received the finding, what response followed and what the company told the agency afterward. We examine that sequence because the annual report and the unresolved finding can describe the same system very differently.

Why Centene Joined the Settlement

Centene acquired all the issued and outstanding shares of Health Net Inc., Health Net Federal Services’ corporate parent, in 2016 and assumed Health Net Federal Services’ liabilities. The operating company supplied the TRICARE administration service, and Centene joined it in the agreement to pay.

What the Civil Settlement Covered

Of the civil settlement, the agreement designated $5,626,700 as restitution. The companies agreed to resolve the government’s False Claims Act allegations over cybersecurity compliance and the annual reports. The Justice Department’s Civil Division and the U.S. Attorney’s Office for the Eastern District of California handled the matter, with investigative and audit assistance from the Defense Department’s inspector general and cybersecurity assessors from the Defense Contract Management Agency.

What Evidence Is Needed to Prove Fraud?

For an annual-certification case, the useful evidence connects the security promise, the actual system condition and the government contract. We build that comparison with the insider: what the System Security Plan required, what dated scan and remediation records show, and what the annual report told the agency. Audit findings and management responses help connect the company’s knowledge of a weakness with its later assurances.

The contract’s payment structure determines which financial records matter. That is why we bring security knowledge and contract knowledge together: the person who understands an overdue fix may see something that is invisible in an ordinary payment review. Our work is to connect that operational account to the representation and the government’s money.

The Audit-Day Picture Can Miss the Rest of the Year

A separate whistleblower complaint against MORSECORP alleged a plan to become compliant for an audit and then return to noncompliant practices. The complaint described the proposal in unusually direct terms:

The complaint alleged that the whistleblower objected because vulnerability management and change management required a continually generated body of data. That history would show the period before the audit, including whether the company had followed its policies. Security by appointment, under the alleged plan. Then back to business until the next one.

The MORSECORP allegation shows why records over time can matter to a cybersecurity case. In Health Net’s matter, the government likewise alleged a gap between compliance reports and the underlying security work, including untimely scanning and remediation. Comparing the report with the work throughout the period it covers gives an insider’s account its substance.

A 2022 study in the International Journal of Management and Humanities, Compliance and Ethics Programs in Department of Defense Government, examined 49 defense contractors and found higher recorded penalty measures among companies with compliance and ethics programs. For us, that finding reinforces the question about compliance on paper: what did people actually do with the program? The scans, fixes and responses to warnings give an insider something concrete to put against an annual assurance.

Cybersecurity Knowledge Can Support a Whistleblower Case

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. In a cybersecurity matter, your knowledge of the systems, audit findings or certification process can help explain why an assurance to the government was false. We work with you to connect that knowledge to the company’s decisions and the contract it was being paid to perform.

You Know What the Annual Report Left Out

If you saw audit findings remain unresolved while the company certified compliance, you know where the annual report and the security work parted company. We build the case with you, stay beside you through the process and bring in cybersecurity fraud whistleblower lawyers who understand defense contracts and the technical records behind a certification. Speak with our whistleblower experts about building your strongest cybersecurity whistleblower case.