The Annual Report Said Compliant.

TRICARE is the Department of Defense's health benefits program, covering medical, dental, and pharmacy services for active duty military personnel, veterans, and their families. Because TRICARE enrollees include active duty servicemembers, the program's records contain not only HIPAA-protected health information but potentially sensitive location and operational data. HNFS held a contract with the Defense Health Agency to administer TRICARE across 22 states, providing information management and information technology support for the program.

The HNFS contract required compliance with 51 security controls specified in NIST SP 800-53, implementation of DFARS cybersecurity requirements, and annual submission of an A-110 NIST Certification of Compliance affirming that the required controls were implemented correctly, operating as intended, and supporting DHA's security policies. HNFS was also required to maintain a System Security Plan defining its own vulnerability response timelines. The annual certification was the mechanism by which DHA received assurance that the access HNFS held to TRICARE systems and data corresponded to a security posture meeting defined requirements.

Between 2015 and 2018, HNFS submitted annual certifications affirming compliance with the required cybersecurity controls. The Department of Justice alleged that those certifications were false. HNFS had failed to timely scan its networks and systems for known vulnerabilities and had not remediated security flaws within the response times defined in its own System Security Plan. Critically, internal audits and third-party security assessors had identified these deficiencies and made recommendations. HNFS did not implement them. The certification that DHA received each year said the controls were in place and operating as intended. HNFS's own internal record said they were not.

The DOJ announced the $11,253,400 settlement on February 18, 2025. There was no allegation that a data breach had occurred or that servicemember data had been lost or exfiltrated. The False Claims Act liability arose not from harm that had been realized but from the knowing submission of false compliance certifications as a condition of continued contract performance. The government did not need to show that HNFS's deficient security posture had produced a specific incident. It needed to show that the certification was false and material to the government's decision to continue the contract.

The annual A-110 certification functioned as an access credential. It asserted, on a recurring basis, that HNFS's security posture met the requirements under which its access to TRICARE systems and data was authorized. DHA relied on the certification. It had no independent mechanism to evaluate whether the certified posture corresponded to actual controls at the point of reliance. The certification was the instrument. HNFS's internal security state was not evaluable by DHA through the certification itself.

The structural condition this case documents is the same one present across the catalog in different institutional contexts: a credential that encodes an assertion without encoding the evidentiary boundary between what was asserted and what was actually verified. HNFS's own auditors and third-party assessors had evaluated the actual security posture. Their findings were not encoded in the credential submitted to DHA. The gap between what the certification asserted and what the internal record showed was not required to appear. It was not evaluable by the relying party at the point of reliance.

The settlement established that no data breach is required to demonstrate credential authority failure in this context. The credential was material to the government's access decision. When the credential was false, the access it authorized was not grounded in the security posture it represented. The access condition — a contractor security posture meeting defined requirements — was not present. The credential said it was.

The Department of Justice settled the matter for $11,253,400 under the False Claims Act, with both HNFS and Centene Corporation as settling parties. The investigation was initiated by the government without a qui tam relator, indicating the DOJ identified the potential violation through its own enforcement activity rather than a whistleblower filing. HNFS denied the allegations and stated that no breach or loss of servicemember data had occurred. The settlement resolved the matter without a determination of liability. Both HNFS and Centene's participation in the settlement extended liability to the parent corporation for conduct that predated Centene's 2016 acquisition of Health Net Inc.