iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Health Net Federal Services, LLC (HNFS) and its parent, Centene Corporation, agreed to pay $11,253,400 to resolve U.S. government allegations that HNFS failed to meet cybersecurity requirements and submitted false compliance certifications under its Defense Department contract supporting TRICARE. The settlement, announced February 18, 2025, is not a finding of wrongdoing: the companies denied the allegations, and the Justice Department says liability was not determined.
Why HNFS and Centene agreed to pay $11.25 million
The U.S. Department of Justice said the civil settlement resolves False Claims Act allegations tied to reimbursement claims and cybersecurity certifications under HNFS’s contract with the Defense Health Agency (DHA). The government alleged that HNFS received payment for contract work while failing to meet cybersecurity obligations and falsely reporting compliance. The agreement does not establish that the allegations were true.
HNFS was a managed healthcare support contractor for TRICARE, not the military health agency that administers the program. The contract at issue, known as T3, covered managed support services for TRICARE’s North region, which included approximately 22 states in whole or in part. Services included claims processing, referral management, enrollment support, provider-network development, and administrative support.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWhat cybersecurity failures did the government allege?
The contract required compliance with specified cybersecurity requirements, including 51 controls from NIST Special Publication 800-53, Revision 4, and annual compliance reports to DHA. The United States alleged that HNFS did not scan for known vulnerabilities and fix flaws within the timeframes in its System Security Plan and its own response standards.
#1 Best Overall
The government also alleged that HNFS failed to address internal and third-party audit findings involving:
- Asset management and access controls
- System configurations and firewalls
- End-of-life hardware and software
- Patch management and vulnerability scanning
- Password policies
The agreement says the United States alleged false attestations for at least seven controls in reports submitted on or about November 17, 2015, February 26, 2016, and February 24, 2017. The agreement describes the conduct covered by the allegations as spanning March 27, 2015, through March 30, 2018; the relevant T3 contract period ran through March 30, 2018, after DHA exercised three 12-month options.
Does the settlement prove TRICARE member data was stolen?
No. The settlement does not establish that data was exfiltrated, lost, or accessed by an unauthorized party. The agreement says the government’s reimbursement allegations applied regardless of whether data was exfiltrated or lost. HNFS and Centene denied that any data exfiltration or loss resulted from the alleged conduct.
The Justice Department’s announcement and the settlement agreement do not establish a number of affected TRICARE members or records, or quantify beneficiary losses. The settlement amount should not be read as a measure of breach impact.
Rank #3
What does the settlement require?
HNFS and Centene agreed to pay $11,253,400. The settlement agreement allocates $5,626,700 of that amount to restitution and provides for four percent annual interest on the settlement amount from January 23, 2025, until payment.
The agreement is not an admission of liability by either company, and it is not a concession by the United States that its claims lack merit. DOJ stated that the claims were allegations and that there had been no determination of liability.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the case says about contractor cybersecurity compliance
The dispute centered on whether contract requirements were followed and accurately certified—not on a government finding that a particular security failure caused a confirmed breach. For federal contractors, the agreement’s compliance themes are operational and auditable:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Run vulnerability scans and remediate findings within documented timeframes.
- Track audit findings through resolution, including findings involving assets, access, configurations, and end-of-life systems.
- Keep evidence that required controls are operating as represented.
- Ensure recurring compliance reports accurately reflect control status when submitted.
These are themes reflected in the contract and allegations; they are not a finding that any specific practice would have prevented a breach. DOJ’s announcement quoted Acting Assistant Attorney General Brett A. Shumate: “Companies that hold sensitive government information, including sensitive information of the nation’s servicemembers and their families, must meet their contractual obligations to protect it.” Acting U.S. Attorney Michele Beckwith likewise described the alleged conduct as a breach of duty in her statement accompanying the settlement announcement; that statement was not a judicial finding.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
