Every claim a revenue cycle team sends to Medicare, Medicaid or a commercial payer is a certification that the service was performed, documented, coded and priced as the rules require. Compliance is the system that makes that certification true before the claim goes out, catches it when it is not, and fixes it in the way the law expects. This tutorial covers the seven elements of a compliance program, the False Claims Act, the Anti-Kickback Statute and Stark law, civil monetary penalties and exclusion screening, the 60-day overpayment rule, HIPAA as it applies to billing, the billing risk areas regulators audit, how to sample and monitor, and what enforcement looks like in 2026.
Documentation, coding, provider enrollment, exclusion status and the arrangements behind the referral all have to be clean.
Most compliance failures are not fraud. They are process gaps that repeat across thousands of claims.
Risk assessment, sampled audits, data monitoring and a reporting line that staff actually use.
The government finds problems with data mining and whistleblowers. A program that cannot find its own is behind.
Stop the error, quantify it, report and return the overpayment within 60 days, and choose the right disclosure path.
Retaining a known overpayment is itself a False Claims Act violation, whatever caused it.
Program integrity is the government's term for protecting Medicare, Medicaid and other federal health programs from improper payment. Compliance is the provider's answer: a structured program that keeps billing accurate, keeps financial relationships lawful, protects patient information, and corrects errors quickly when they happen.
For revenue cycle staff the subject is not abstract. The False Claims Act attaches to the claim itself, so the registrar who captures the wrong payer, the coder who levels a visit, the biller who adds a modifier to clear an edit, and the posting clerk who leaves a credit balance unrefunded are all handling the same legal object. Compliance programs exist because the government does not accept "we did not know" as a defense when the organization could have known, and because the penalties scale with the number of claims, not the size of the mistake.
The field is built on a small number of laws that fit together. The False Claims Act is the enforcement engine: it turns any knowingly false claim into treble damages and per-claim penalties, and it lets private whistleblowers sue on the government's behalf. The Anti-Kickback Statute and the Stark law govern the money that moves around referrals; a claim tainted by either is a false claim. The Civil Monetary Penalties Law and the exclusion authorities give the HHS Office of Inspector General (OIG) its own administrative remedies. The 60-day rule makes keeping a known overpayment an FCA violation. HIPAA protects the patient information the revenue cycle runs on. Around all of it sits OIG's compliance program guidance, which describes what an effective program looks like and what the government expects to find when it comes to look.
False Claims Act settlements and judgments in federal fiscal year 2025, the highest single year in the statute's history. More than $5.7 billion came from health care: managed care, drugs and devices, unnecessary services and kickbacks. The Department of Justice announced the totals on January 16, 2026.
The civil penalty for each false claim, on top of three times the government's damages. These 2025 inflation-adjusted amounts still apply in 2026 because the Office of Management and Budget made no 2026 adjustment (Memorandum M-26-11, April 17, 2026) after the October 2025 CPI data was never published.
Filed in fiscal year 2025, the most ever (980 the year before). Qui tam cases produced more than $5.3 billion of the year's recoveries, and relators typically keep 15% to 30% of what the government collects. Most begin with an employee who raised the issue internally first.
A single misconfigured charge, modifier rule or E/M template repeats across every claim it touches. Because penalties attach per claim, a $40 error on 5,000 claims is not a $200,000 problem; it is a multi-million-dollar one once trebled and penalized.
A medical director agreement without a signed contract, rent below market, or a bonus tied to referrals makes every resulting Medicare claim false, regardless of whether the care was good and the codes were right.
Overpayments found by an internal audit and left in a spreadsheet become reverse false claims after 60 days. Excluded employees left on payroll generate penalties per item billed. The law punishes delay more than discovery.
Statements mailed to the wrong address, remittance files sent to the wrong vendor, offshore billing staff without a business associate agreement. Each is a reportable breach with its own investigation.
Staff who report concerns and see nothing happen call the OIG hotline or a lawyer. Relators told investigators, in case after case, that they tried internal channels first.
Settlements over a threshold usually carry a five-year CIA: an independent review organization, annual claims reviews, board certifications and reporting. Expensive, public and avoidable.
OIG's General Compliance Program Guidance (GCPG), published November 6, 2023, replaced the compliance guidance documents of 1998 to 2008 with one reference for every provider type, and promised industry segment guidance to follow. The Nursing Facility guidance arrived November 20, 2024 and the Medicare Advantage guidance on February 3, 2026. The seven elements are the skeleton of every one of them, and of the Federal Sentencing Guidelines, Medicare Advantage regulations and most state Medicaid requirements.
The elements are not a checklist to be completed once. OIG evaluates whether a program is effective: whether it actually finds and fixes problems. A binder of policies with no audits, a hotline with no calls, or a compliance officer with no budget is evidence of a paper program, and in settlement negotiations a paper program is treated much like no program at all.
| Element | Revenue cycle control | Evidence an auditor will ask for | Common gap |
|---|---|---|---|
| Policies | Coding and billing policy, modifier policy, credit balance and refund policy, charge capture reconciliation, ABN policy, physician contracting policy | Dated, approved documents with version history; evidence staff received them | Policies written for the EHR of 2015 and never updated; no credit balance policy at all |
| Leadership | Compliance committee includes the revenue cycle director; compliance officer reviews new service lines and billing changes before go-live | Committee minutes, board reports, organization chart | Compliance officer reports to the CFO whose bonus depends on collections |
| Training | Coders and billers trained annually on E/M, modifiers, NCCI, incident-to and the year's code changes; registrars on identity, MSP and privacy; physicians on documentation | Completion logs by name, date and content; test results | Training delivered once at hire; providers exempted |
| Communication | Hotline posted in billing areas; "stop the line" process for a biller who thinks a claim is wrong; feedback loop from denials to coding | Hotline log, investigation files, response times | Staff do not know the hotline exists; concerns raised to a manager go nowhere |
| Enforcement | Coding accuracy in performance reviews; productivity targets paired with accuracy floors; discipline for overriding edits without authority | Discipline records, incentive plan documents | Coders paid per chart with no accuracy measure; physician compensation tied to wRVUs with no documentation audit |
| Auditing | Annual risk assessment, prospective and retrospective coding audits, modifier 25/59 monitoring, credit balance aging, monthly exclusion screening, denial trend review | Audit plan, sampling method, findings, corrective actions, re-audits | Audits done but findings never translated into refunds or re-training |
| Response | Overpayment workflow with the 60-day clock, refund mechanics for each payer, decision tree for self-disclosure | Overpayment log with identification dates, amounts, refund confirmations | Overpayment found in March, refunded in November |
The GCPG accepts that a small physician group cannot employ a full-time compliance officer. It expects a named compliance contact, a short code of conduct, training, a way to report concerns, a risk list that fits the practice (usually coding, incident-to, credit balances, exclusion screening and privacy), and a documented response when something is found. Scale changes the size of the program, not the seven elements.
OIG, DOJ and the Sentencing Guidelines all ask the same questions: Is the program well designed for this organization's risks? Is it applied in good faith, with resources and authority? Does it work in practice, meaning it detects, corrects and improves? The DOJ Criminal Division's corporate compliance evaluation uses exactly these three questions. Settlements and CIAs are shaped by the answers.
Voluntary but authoritative. OIG cites them in settlements and CIAs, and the Medicare Advantage ICPG (February 2026) applies the same structure to plans, with risk areas that flow down to contracted providers: risk adjustment coding, access to care, marketing, quality, third-party oversight and vertically integrated ownership.
Defines an "effective compliance and ethics program" for organizations facing criminal sentencing. The same seven elements plus a requirement to periodically evaluate the program and to incentivize compliance, which the 2023 GCPG echoed.
Medicare Advantage and Part D sponsors must operate a compliance program with the seven elements (42 CFR 422.503(b)(4)(vi) and 423.504(b)(4)(vi)) and flow the obligation to first-tier, downstream and related entities. Many state Medicaid programs and managed care contracts require the same of providers above a size threshold.
The False Claims Act (31 U.S.C. 3729–3733) is a Civil War statute that became the government's main health care fraud tool after the 1986 amendments strengthened whistleblower rewards. It imposes liability on anyone who knowingly presents, or causes to be presented, a false or fraudulent claim for payment to the federal government, or who knowingly keeps money the government overpaid.
Three features explain its reach. "Knowingly" does not require intent to defraud: actual knowledge, deliberate ignorance, or reckless disregard of the truth is enough. Damages are trebled and penalties attach per claim, so volume drives exposure. And private persons can sue on the government's behalf and share the recovery, which gives every employee with access to the billing system a financial incentive to report what the organization will not fix.
Services not rendered, wrong provider, wrong date, upcoded level, units inflated, unbundled components. The claim misstates a fact the payer relies on. Most billing-error FCA cases are here.
The CMS-1500 and UB-04 certifications and the 837's implicit attestations state that the services were medically necessary, personally furnished or properly supervised, and that the submitter complied with applicable laws. A false certification makes the claim false.
The Supreme Court held a claim can be false by implication when it makes specific representations and omits noncompliance with a material requirement. Materiality means the government would likely have refused payment had it known; a rule the government routinely ignores when paying is not material.
Knowingly concealing or improperly avoiding an obligation to pay the government. Since 2009 "obligation" expressly includes the retention of an overpayment, and the 60-day rule (chapter 06) defines when retention becomes knowing.
The Anti-Kickback Statute says a claim that includes items or services resulting from a kickback "constitutes a false or fraudulent claim" (42 U.S.C. 1320a-7b(g)). Stark prohibits Medicare payment for prohibited referrals, so billing for them is a false certification. Chapter 04 covers both. The point here is that FCA exposure is not limited to coding: arrangements create it.
| Component | Amount (2026) | Notes |
|---|---|---|
| Damages | 3 × government loss | Treble damages on the amount the government paid because of the false claims. Courts debate whether the value of care delivered offsets the loss; in billing cases the loss is usually the overpayment itself. |
| Reduced damages for cooperation | 2 × loss | Available when the defendant gave the government all known information within 30 days of learning of the violation, fully cooperated, and disclosed before any action began and without knowledge of an investigation (31 U.S.C. 3729(a)(2)). |
| Civil penalty per claim | $14,308 – $28,619 | Set by DOJ's 2025 inflation adjustment for penalties assessed after July 3, 2025. No 2026 adjustment was made (OMB M-26-11). Courts have discretion within the range and, in some circuits, may reduce penalties that would be grossly disproportionate. |
| Relator's share | 15% – 30% | 15% to 25% when the government intervenes; 25% to 30% when it declines and the relator litigates alone. Paid from the recovery, plus attorney fees from the defendant. |
| Statute of limitations | 6 / 3 / 10 years | The later of six years from the violation, or three years after the responsible government official knew or should have known the facts, capped at ten years from the violation (31 U.S.C. 3731(b)). |
| Retaliation remedies | 2 × back pay | Reinstatement with seniority, double back pay with interest, special damages and attorney fees for an employee, contractor or agent retaliated against for lawful acts in furtherance of an FCA action or efforts to stop a violation (31 U.S.C. 3730(h)). Three-year filing window. |
A coder, biller, nurse or sales representative sees a pattern. Many first raise it internally. If nothing changes, they consult a relator's attorney, who evaluates whether the facts show knowing falsity and material loss.
The complaint is filed under seal in federal court and served on the government, not the defendant, with a written disclosure of substantially all material evidence. The seal lasts at least 60 days and is routinely extended for years while the government investigates.
DOJ and OIG issue civil investigative demands and subpoenas, interview witnesses and analyze claims data. The defendant often learns of the case only when a CID or a subpoena for records arrives, and may never learn a relator is behind it until unsealing.
The government intervenes and takes over, declines and lets the relator proceed, or moves to dismiss. Intervened cases produce most of the dollars; declined cases are increasingly litigated by relators and can still settle for large amounts.
Most cases settle. Settlement multipliers are typically below treble, and per-claim penalties are usually folded into a negotiated amount. Health care settlements above a threshold commonly carry a corporate integrity agreement with OIG, and individuals may face exclusion.
More than $5.7 billion from health care. 401 new government-initiated matters and 1,297 qui tam filings, both records. DOJ named managed care, drug and device pricing, unnecessary services, kickbacks and cybersecurity as the leading areas.
Priorities: Medicare Advantage risk adjustment, drug and device pricing and rebates, barriers to care including network adequacy, kickbacks for products, defective devices, and manipulation of EHR systems to drive utilization. The group uses data mining and OIG findings, and discusses payment suspensions under 42 CFR 405.370.
A Florida district court had held in 2024 that relators are unconstitutionally appointed officers. The Eleventh Circuit vacated that ruling on September 1, 2026, holding relators are not officers of the United States, and remanded other constitutional arguments. Qui tam enforcement continues unchanged.
Reckless disregard is the standard that catches organizations. Ignoring a denial pattern that signals a coding problem, continuing to bill after an auditor flags a modifier practice, running an EHR template that defaults to a high level, or not screening for exclusions because "no one told us to" can each be argued as reckless disregard. The defense is a documented program that looks, finds and fixes, and a record of acting within 60 days when it does.
Both laws police the money that flows around referrals. They overlap but are built differently: the Anti-Kickback Statute is a criminal intent-based law that reaches anyone and any federal program; Stark is a civil strict-liability law aimed at physicians' financial relationships with the entities they refer Medicare patients to for designated health services. Revenue cycle teams meet them in physician contracts, patient incentives, discounts, marketing and the question of whether a claim is billable at all.
| Safe harbor (42 CFR 1001.952) | Core conditions | Revenue cycle relevance |
|---|---|---|
| Space and equipment rental (b), (c) | Written, signed, term of at least one year, aggregate rent set in advance, fair market value, not based on volume or value of referrals, commercially reasonable | Hospital leasing space to referring physicians, or renting equipment from them. Below-market rent to a referral source is the classic kickback. |
| Personal services and management contracts (d) | Written, signed, covers all services, term of at least one year, compensation methodology set in advance, FMV, not tied to referrals; outcomes-based payments allowed since 2021 if tied to measurable quality or cost goals | Medical directorships, call coverage, billing company fees. A percentage-of-collections fee to a billing company is outside the safe harbor and must be judged on intent (OIG has flagged percentage arrangements as higher risk). |
| Employees (i) | Bona fide employment relationship; any amount paid for furnishing covered items or services | Protects salaries and bonuses to employed staff, including employed physicians, but not independent contractors. |
| Discounts (h) | Price reductions disclosed and reflected on claims and cost reports; buyer and seller duties; no "swapping" of discounts for referrals of other business | Vendor discounts, lab pricing to physician clients, GPO fees. Discounts must be passed through accurately in what is billed. |
| Waiver of cost sharing (k) | Hospital waivers of Part A inpatient cost sharing not advertised or routine; pharmacy and ambulance provisions; otherwise, waivers need an individualized financial need determination | Routine copay waivers and "insurance only" billing are kickbacks to patients. Financial hardship waivers must be documented case by case. |
| Local transportation (bb) | Free local transport (25 miles urban, 50 rural) for established patients, not advertised, not air or luxury, not paid per referral | Patient shuttle programs. |
| EHR and cybersecurity donations (y), (jj) | Hospitals may donate interoperable EHR items (recipient pays 15%) and cybersecurity technology and services to referral sources under conditions | Health system IT offered to community physicians. |
| Value-based arrangements (ee), (ff), (gg) | Three tiers (care coordination in-kind, substantial downside risk, full financial risk) created by the 2020 rule for arrangements within a value-based enterprise | ACO, bundled payment and care coordination payments between hospitals and physicians. |
| Patient engagement and support (hh) | In-kind tools and supports up to an annual per-patient limit from a VBE participant, connected to care coordination | Remote monitoring devices, transportation vouchers under a value-based program. |
A separate civil monetary penalty (42 U.S.C. 1320a-7a(a)(5)) bars offering Medicare or Medicaid beneficiaries anything of value that is likely to influence their choice of provider. OIG treats items of nominal value, no more than $15 per item and $75 per patient per year (policy since December 2016), as permissible, and the 2016 rules added exceptions for items that promote access to care with a low risk of harm, financial-need-based cost-sharing waivers, and certain retailer rewards. Free screenings, gift cards for appointments and waived balances need to be checked against these rules before marketing runs them.
| Feature | Anti-Kickback Statute | Stark law |
|---|---|---|
| Nature | Criminal, plus civil and administrative | Civil, strict liability |
| Who | Anyone offering or receiving remuneration | Physicians (and family) and DHS entities |
| What | Any items or services under any federal health care program | Designated health services under Medicare (Medicaid through a separate provision) |
| Intent | Knowing and willful; one purpose test | None required |
| Safe harbors / exceptions | Voluntary; outside a safe harbor is judged on facts | Mandatory; outside an exception is a violation |
| Advisory process | OIG advisory opinions | CMS advisory opinions |
| Disclosure path | OIG Self-Disclosure Protocol (minimum $100,000 settlement) | CMS Self-Referral Disclosure Protocol (Stark-only conduct) |
| Enforcement | DOJ (criminal and FCA), OIG (CMP, exclusion) | CMS (denial, refund), DOJ via FCA, OIG (CMP) |
Waiving or never pursuing cost sharing, "professional courtesy" to referring physicians' families, or advertising "we accept what insurance pays" are inducements. Hardship waivers are allowed only with a documented, individual financial need assessment.
If a physician's lease lapsed, the DHS referred during the gap cannot be billed to Medicare. Contract management and billing holds have to talk to each other.
Billing companies paid a percentage of collections, marketers paid per patient, and lab or DME arrangements paid per order are outside the safe harbors. Not illegal in themselves, but they need counsel review and documented safeguards.
Gift cards for completing screenings, waived balances for reviews, free transportation beyond the safe harbor. Marketing programs should be screened before launch, not after a complaint.
Discounts from suppliers must be reflected accurately in charges and cost reports. A hospital that receives a discount and reports full price breaks the discount safe harbor.
A contract database with execution dates, terms, FMV support and renewal alerts; a rule that no referral-source arrangement is paid without a signed agreement; and an annual review of physician compensation against FMV and commercial reasonableness.
The Civil Monetary Penalties Law (42 U.S.C. 1320a-7a; 42 CFR Part 1003) gives OIG an administrative path that does not need a court or the Department of Justice. OIG can impose penalties per item or service, add an assessment of up to three times the amount claimed, and exclude the person or entity from federal health care programs. Exclusion is the sanction that makes screening a daily revenue cycle task: anything an excluded person touches that is billed to a federal program is an overpayment.
HHS published its 2025 inflation adjustment on January 28, 2026 (effective that day for penalties assessed on or after it). Because no 2026 adjustment was made, these are the amounts in effect as of October 2026.
| Conduct | Penalty per item or violation | Plus |
|---|---|---|
| Presenting a claim for an item or service not provided as claimed, or that is false or fraudulent (42 CFR 1003.210(a)(1)) | $25,595 | Assessment up to 3 × the amount claimed; exclusion |
| Claim for a service furnished by an excluded person, or employing or contracting with one (1003.210(a)(4)) | $25,595 | Assessment up to 3 × amount claimed; exclusion. Applies when the provider knew or should have known |
| Claim for a service ordered or prescribed by an excluded person | $25,595 | Same |
| False record or statement material to a false claim (1003.210(a)(7)) | $72,163 | Assessment; exclusion |
| Kickbacks: soliciting, receiving, offering or paying remuneration (1003.310(a)(3)) | $127,973 | 3 × the remuneration; exclusion |
| Beneficiary inducement (1003.1010) | $25,595 | Assessment; exclusion |
| Hospital or physician payments to reduce or limit services (gainsharing CMP) | $6,398 | Per patient |
| Stark: claim for a prohibited referral (42 U.S.C. 1395nn(g)(3)) | $31,670 | Per service; refund; exclusion |
| Stark: circumvention scheme (1395nn(g)(4)) | $211,146 | Per scheme |
Conviction of a program-related crime, patient abuse or neglect, felony health care fraud, or felony controlled-substance offenses. OIG has no discretion; a second conviction brings ten years, a third is permanent.
Misdemeanor fraud, license revocation or surrender, defaulted health education loans, CMP violations, kickbacks, furnishing unnecessary or substandard services, failure to supply information, controlling an excluded entity, and more. OIG weighs aggravating and mitigating factors.
No federal health care program payment for any item or service furnished, ordered, prescribed or directed by an excluded person, or for administrative and management services they perform. OIG's 2013 Special Advisory Bulletin lists examples: billing, coding, IT support, HR, strategic planning, executive roles, filling prescriptions, reviewing treatment plans. Only services to non-federal patients, or that no federal program pays for even indirectly, are outside it.
Exclusion lasts until OIG grants reinstatement after the term ends. A screening hit does not expire on its own; the name stays on the LEIE until reinstated. Check the reinstatement date, not the exclusion start date.
Employees, medical staff, contractors, locums, agency staff, volunteers with patient contact, board members, vendors that touch claims (billing companies, coding vendors, collection agencies), and the owners and managing employees of those vendors. Ordering and referring physicians outside the organization should be screened where their orders generate your claims (DME, lab, home health, imaging).
There is no statute setting a frequency, but OIG recommends monthly because the LEIE is updated monthly, and CMS requires state Medicaid agencies to screen enrolled providers' owners and managing employees monthly (42 CFR 455.436). Many state Medicaid programs and managed care contracts impose monthly screening on providers directly.
OIG's List of Excluded Individuals/Entities is the list that supports OIG's CMP; it is the mandatory source. Also screen the GSA System for Award Management (SAM) for federal debarments, your state Medicaid exclusion or termination list, and the state lists of any other state you bill. Licensure boards and the NPDB are credentialing sources, not exclusion sources.
Name matches are common. Verify with the LEIE's Social Security number or EIN check, date of birth and the exclusion type. Document the search date, the search terms, the result and who cleared it. A documented negative search is your evidence of "should not have known."
Remove the person from any role touching federal program patients or claims. Quantify the claims involved since the exclusion date (or since hire). Report and return the overpayment within 60 days and consider the OIG Self-Disclosure Protocol, which OIG specifically invites for excluded-person matters and resolves with a formula based on the person's compensation.
CMP liability for employing an excluded person needs only that the provider knew or should have known. A provider that never screened, screened only at hire, or ignored a match is in the "should have known" category. Vendors are not a shield: if a billing company's coder is excluded, the provider that submitted the claims is liable alongside the vendor. Contracts with staffing agencies and billing vendors should require monthly screening and give you the right to audit it.
Section 1128J(d) of the Social Security Act (42 U.S.C. 1320a-7k(d)), added by the Affordable Care Act in 2010, requires anyone who has received a Medicare or Medicaid overpayment to report and return it within 60 days of identifying it, or by the date a corresponding cost report is due, whichever is later. An overpayment kept past that deadline is an "obligation" under the False Claims Act, and keeping it is a reverse false claim. The rule converts ordinary billing errors into fraud exposure when the organization knows and does not act.
The CY 2025 Physician Fee Schedule final rule (published December 9, 2024) rewrote 42 CFR 401.305. An overpayment is identified when the person has actual knowledge of it, or acts in deliberate ignorance or reckless disregard of whether it exists. The 2016 rule's "reasonable diligence" standard and its six-month investigation allowance are gone. For Parts A and B, the overpayment no longer has to be quantified to count as identified.
When a Part A or B overpayment is identified and a timely, good-faith investigation into related overpayments is underway, the 60-day deadline for the related overpayments is suspended until the investigation concludes and the total is calculated, or 180 days after the initial identification, whichever comes first. Document the start, scope and progress of the investigation; the suspension depends on it.
Overpayments must be reported and returned if identified within six years of the date they were received (42 CFR 401.305(f)). Audits that find a systemic error should quantify it back six years, not just the current year.
The statute covers Medicaid (reported to the state) and applies to Medicare Advantage and Part D through their own regulations (42 CFR 422.326 and 423.360), which require plans to report and return overpayments identified within six years and to push the same obligation into their provider contracts.
| Path | When it fits | Mechanics | What you get |
|---|---|---|---|
| Claims adjustment or voluntary refund to the MAC | Ordinary billing errors with no indication of fraud or kickbacks; identified amount can be calculated or reasonably estimated | Submit corrected or voided claims, or use the MAC's voluntary refund form with a check or offset request and a statement of the reason; for systemic errors, an extrapolated estimate with the methodology. Medicaid: the state's refund process | Satisfies the 60-day rule. No release from the FCA, but a documented, timely return defeats the "knowingly retained" element |
| OIG Self-Disclosure Protocol (SDP) | Conduct that may violate federal criminal, civil or administrative law for which CMPs apply: kickbacks, excluded persons, false claims with potential knowledge. Not for Stark-only conduct | Written disclosure with the conduct, the period, the damages estimate (sample of at least 100 claims if sampling) and an internal investigation; damages calculation due within 90 days of the initial submission | OIG's general practice: 1.5 × single damages, minimum settlement $100,000 for kickback matters and $20,000 for others, release of CMP and usually no CIA. FCA release only if DOJ joins; the disclosure tolls the 60-day clock while it is pending |
| CMS Self-Referral Disclosure Protocol (SRDP) | Actual or potential Stark violations only, with no kickback concern | CMS forms describing the arrangement, the noncompliance, the period and the DHS claims involved; CMS may reduce the amount owed based on listed factors | Settlement at a reduced amount; the SRDP suspends the 60-day deadline while the disclosure is pending |
| Disclosure to DOJ | Potential FCA liability where an FCA release is the goal, or when a qui tam may already exist | Through counsel; DOJ's cooperation credit policy can reduce the multiplier toward double damages | FCA release and possibly reduced damages; often paired with an OIG release |
Duplicate payments, primary and secondary both paying as primary, contractual adjustment posted after payment, MSP situations. Medicare credit balances must be reported quarterly on the CMS-838 and refunded; the 60-day clock runs from identification, which for a credit balance is usually the day it appears on the aging report.
Overpaid copays, estimates that exceeded the final patient responsibility, duplicate patient payments. Refund promptly; unrefunded patient credits become unclaimed property under state escheat law after the dormancy period, and some states audit for them.
Weekly credit balance report by payer, aged; a small-balance threshold for review; a rule against netting credits against other balances without the payer's process; and reconciliation of the CMS-838 to the general ledger. Credit balances are the most common finding in revenue cycle compliance audits.
Record the date credible information arrived (an audit finding, a denial pattern, a hotline report, a payer letter). This is the earliest date anyone will argue the clock started. Assign an owner.
Fix the charge, the template, the edit or the enrollment that caused it. Hold affected claims if the error is ongoing. Continuing to bill after you know is the fact pattern DOJ likes least.
Pull the affected claims. If the volume is large, use a statistically valid sample and extrapolate; document the method. Look back six years. Decide with counsel whether the facts suggest kickbacks, Stark or knowing conduct that points to a disclosure protocol rather than a MAC refund.
Use the path from the table. Keep the refund confirmation, the cover letter and the calculation. If using the SDP or SRDP, the submission date is what matters; the settlement comes later.
Re-train, re-audit in 90 days, update the policy, and record the matter in the compliance log with root cause and corrective action. The next auditor will ask what you did after you found it.
Billing is a permitted use of protected health information; that is why the revenue cycle can function at all. But payment activities touch more PHI, with more outside parties, than almost any other function: clearinghouses, payers, billing and coding vendors, collection agencies, statement printers, lockbox banks, offshore teams and patient portals. HIPAA's Privacy, Security and Breach Notification Rules (45 CFR Parts 160 and 164) decide what each may see and what happens when something leaks.
Administrative, physical and technical safeguards with "required" and "addressable" implementation specifications. The foundation is an accurate, enterprise-wide risk analysis (164.308(a)(1)(ii)(A)) and a risk management plan. OCR's Risk Analysis Initiative, launched in 2024, has produced a steady run of settlements and penalties, many following ransomware attacks, against entities that could not show a current risk analysis.
HHS proposed removing the "addressable" category and making controls mandatory: encryption of ePHI at rest and in transit, multifactor authentication, a written technology asset inventory and network map, vulnerability scans every six months and penetration tests every year, 72-hour restoration of critical systems, annual compliance audits, and risk analysis reviewed at least every 12 months. The comment period closed March 7, 2025 with more than 4,700 comments. The Unified Agenda now lists final action for July 2027; as of October 2026 the current rule still governs, but OCR enforces the existing risk analysis requirement as if the practices were already expected.
| Step | Rule | Billing examples |
|---|---|---|
| Is it a breach? | Acquisition, access, use or disclosure not permitted by the Privacy Rule is presumed a breach unless a documented four-factor risk assessment shows a low probability of compromise (164.402). Exceptions for unintentional good-faith access by workforce and inadvertent disclosure between authorized persons. | Statement mailed to the wrong patient; 835 file emailed unencrypted to the wrong vendor; collection agency laptop stolen; portal shows another patient's bill |
| Notify individuals | Without unreasonable delay and no later than 60 calendar days after discovery, by first-class mail (or email if agreed), with substitute notice if contact information is bad | Discovery is the first day the breach is known, or should reasonably have been known, to anyone in the workforce other than the person who caused it |
| Notify HHS | 500 or more individuals: at the same time as individuals. Fewer than 500: log and report within 60 days after the end of the calendar year | Breaches of 500+ appear on the public OCR breach portal |
| Notify media | 500 or more residents of a state or jurisdiction: prominent media outlets within 60 days | A misdirected statement run affecting thousands triggers press notice |
| Business associate | Must notify the covered entity without unreasonable delay and within 60 days; the BAA usually sets a shorter window (often 5 to 10 days) | Your clearinghouse or billing vendor's breach is your notification to make |
| State law | All states have breach laws with their own definitions, deadlines (some 30 or 45 days) and attorney general notices; many cover financial data on statements | Card numbers on a payment plan form are a state-law breach even if not PHI |
Four culpability tiers per violation: did not know ($145 to $73,011); reasonable cause ($1,461 to $73,011); willful neglect corrected within 30 days ($14,602 to $73,011); willful neglect not corrected ($73,011 to $2,190,294). Annual cap per identical provision: $2,190,294. Amounts effective January 28, 2026; OCR applies its 2019 enforcement discretion to lower the caps for the first three tiers.
State AGs can sue under HITECH. The FTC's Health Breach Notification Rule reaches non-HIPAA apps. DOJ now treats knowingly false cybersecurity certifications by federal contractors and grantees as FCA violations, and recovered over $52 million that way in fiscal 2025. The reproductive health care privacy rule of 2024 was vacated nationwide on June 18, 2025 (Purl v. HHS, N.D. Tex.), so its attestation requirement no longer applies.
| Scenario | Rule that applies | Do this |
|---|---|---|
| Appeal letter with the full chart attached | Minimum necessary | Attach the notes, orders and results that support the service; redact unrelated encounters |
| Offshore coding or A/R follow-up team | BAA, Security Rule, state law and payer contracts | BAA with the vendor and its subcontractors; access through controlled VDI with no local storage; check state Medicaid and payer contracts, several of which restrict or require disclosure of offshore PHI access |
| Patient pays cash and asks you not to bill the plan | Right to restrict (164.522) | Honor it; flag the account so the claim is not filed and the service does not appear on a later claim or in a payer data feed |
| Spouse calls to discuss a bill | Personal representatives and involved persons (164.510(b)) | Verify identity; disclose only what is relevant to that person's involvement in payment; honor any patient restriction on file |
| Texting balance reminders | Privacy Rule plus the TCPA and state consent laws | Obtain and record consent; keep PHI minimal in the message; provide an opt-out |
| Collection agency placement | BAA, minimum necessary, FDCPA | Send demographics, dates, balance and payer information; not diagnoses or notes unless legally required; document the BAA and the agency's screening |
| Sharing a claim file with another provider's billing office for COB | Payment disclosure to another covered entity (164.506(c)(3)) | Permitted for their payment activities; limit to the shared patients and the data needed |
Most False Claims Act health care matters are about ordinary billing rules applied badly at scale. The risk areas below recur in OIG Work Plan items, RAC and UPIC reviews, Comparative Billing Reports and settlements. Each has a rule, a way it goes wrong, and a control that an audit program can test.
| Risk area | The rule | How it goes wrong | Control to test |
|---|---|---|---|
| E/M upcoding | Level by medical decision making or total time on the date of the encounter (2021 office, 2023 facility rules); documentation must support the elements | Templates that pre-populate high-complexity MDM; "99214 for everything"; time claimed that exceeds plausible schedules; AI-drafted notes that document more than was done | Provider-level distribution versus specialty peers; chart audit of 10–20 encounters per provider per year; template review |
| Unbundling and NCCI | NCCI procedure-to-procedure edits and medically unlikely edits define what is included in another code | Billing components separately; appending a modifier to bypass an edit without a distinct service | Edit override report: who bypassed which edit with what modifier; sample the overrides |
| Modifier 25 | Significant, separately identifiable E/M on the same day as a minor procedure, beyond the procedure's usual pre- and post-work | E/M billed with every injection, skin lesion removal or test; the note describes only the procedure | Modifier 25 rate by provider; audit the E/M note for a separate problem and work |
| Modifier 59 and X{EPSU} | Distinct procedural service: different session, site, organ system, incision, lesion or injury | Used as the default edit bypass; applied by a scrubber rule rather than a coder reading the note | 59 and XS/XU rate versus peers; prohibit automated 59 rules; audit a sample |
| Incident-to | 42 CFR 410.26: service by auxiliary personnel integral to the physician's plan of care, in a non-facility setting, under direct supervision (physician in the office suite, immediately available), billed under the physician for an established problem | New problems addressed by an NP billed under the physician; physician off site; billing incident-to in a hospital department; no documented plan of care | Schedule cross-check: supervising physician's location on the date; billing provider versus rendering provider report |
| Split or shared visits | 42 CFR 415.140: facility-setting E/M shared by a physician and an NPP in the same group; billed by whoever performed the substantive portion (more than half the total time, or a substantive part of the MDM; critical care by time only); modifier FS required. CY 2026 PFS kept this definition | Physician billing after a brief sign-off; missing FS; both practitioners billing | FS modifier use; audit for the substantive portion documentation and both practitioners' attestations |
| Teaching physician services | 42 CFR 415.172: physician must be present for the key portion of the service (or meet the primary care exception) and document participation; since CY 2026 virtual presence via real-time audio-video is permitted in all training settings | Resident-only services billed under the attending; macro attestations with no personal involvement | Attestation language audit; GC/GE modifier use; resident schedules |
| Cloned and copied documentation | Each encounter's note must reflect that encounter; copied text that is not updated does not support the service | Identical exam and plan across visits; prior-day vitals; "patient states" copied from a year ago | EHR copy-forward audit tools; sample notes for identical blocks |
| Medical necessity and ABNs | Medicare pays only reasonable and necessary services (SSA 1862(a)(1)(A)); LCD and NCD coverage rules; an ABN shifts liability only when properly executed before the service | Diagnosis codes chosen to pass an LCD edit rather than from the record; blanket ABNs; GA modifier without a signed ABN on file | LCD-driven denial trends; ABN audit (timing, signature, specific service and reason) |
| Credit balances and duplicates | 60-day rule; CMS-838 quarterly report; payer contract refund terms | Credits aged over 90 days; credits netted against unrelated debits; duplicate payments retained | Credit balance aging by payer; refund turnaround; CMS-838 reconciliation |
| Place of service and provider identity | POS must match where the service occurred; rendering NPI must be who performed it; locum and reciprocal rules (Q5/Q6) are time-limited | Office POS for hospital outpatient services to get the higher non-facility rate; billing under a credentialed physician for a non-credentialed one | POS versus facility fee claims; rendering NPI versus schedule; credentialing status at date of service |
| Time-based services | Prolonged services, therapy units (8-minute rule for Medicare), care management, critical care, anesthesia time all require documented time | Units that imply more hours than the provider worked; rounding up; overlapping times across patients | Provider time totals per day versus hours worked; overlap report |
| Telehealth | Statutory flexibilities have been extended in short increments since 2020; modifiers (95, 93), POS 02/10, audio-only and originating site rules change by date | Billing in-person codes for audio-only calls; wrong POS; services outside the covered list for the date | Date-sensitive edit table; sample telehealth claims each quarter |
| Risk adjustment diagnoses | Medicare Advantage and ACA diagnoses must be documented in a face-to-face encounter and supported (MEAT: monitored, evaluated, assessed, treated) | Chart reviews that add codes without clinical support; suspect-condition lists pushed to providers; unsupported HCCs in problem lists carried forward | RADV-style audit of a sample of submitted HCCs; one-way (add-only) review programs are a red flag DOJ has named |
Riverside's denial report shows Northwind Health Plan (payer ID 99999) rejecting E/M lines with modifier 25 at twice the rate of other payers. The compliance analyst pulls Dr. Ana Rivera's (NPI 1987654321) claims: 92% of joint injections carry a 99213-25, against a specialty norm near 40%. A 20-chart sample finds that in 14 the note documents only the injection and the problem that prompted it. The group stops the template that auto-adds the E/M, re-trains, and quantifies: 14 of 20 unsupported, extrapolated across 1,160 Medicare claims over six years at an average E/M payment of $86. The estimate, about $69,800, is refunded to the MAC with the methodology within 60 days of the audit report, and the matter is logged with a 90-day re-audit. No kickback or knowing conduct, so no SDP. Had the practice known for a year and kept billing, the same facts would have been a reverse false claim with per-claim penalties on the table.
A scrubber that adds a modifier to clear an edit is making a clinical assertion no one has verified. Edits should stop claims and route them to a person; the person should read the note.
CMS and OIG use outlier analysis; Comparative Billing Reports show you where you stand. Build the same views internally: E/M distribution, modifier rates, units per visit, diagnoses per claim, by provider, monthly.
New service lines, new templates, new AI documentation tools and new billing vendors get a prospective audit of the first 30 to 50 claims before volume ramps. Finding a template error on claim 40 is a correction; on claim 4,000 it is a disclosure.
Element six is where a compliance program proves it is real. Risk assessment decides what to look at, auditing looks, monitoring watches between audits, and sampling makes the results defensible. The methods are the same ones the government uses, so an organization that applies them to itself meets the investigators on their own ground.
Sources: the OIG Work Plan (updated monthly), the DOJ-HHS working group priorities, recent settlements in your specialty, Comparative Billing Reports, RAC and TPE topics, payer audit letters, denial trends, hotline reports, prior audit findings, new service lines, new technology, and physician arrangements added in the year.
A simple 1–5 scale for each, multiplied. Impact considers claim volume (penalties scale per claim), dollars, whether the issue implicates kickbacks or exclusion (which change the disclosure path), and patient harm. Likelihood considers controls already in place and prior findings.
High scores get retrospective audits with defined samples; medium scores get monitoring metrics; low scores get policy review. Record what was deliberately not audited and why; the record shows judgment, which is what effectiveness reviews look for.
Each audit ends in a written report with the method, the sample, the findings, the financial effect, the corrective action, the owner, the refund (if any) and a re-audit date. Report results to the compliance committee and summarize to the board.
A small judgmental or random sample to see whether a problem exists and roughly how big it is. If the error rate is small and the dollars low, document and correct the items found. If the probe suggests a systemic error, move to a statistically valid sample. OIG's corporate integrity agreements have used a 50-item discovery sample for the same purpose.
Random selection from a defined universe (claims, lines, encounters) over the lookback period; a sample large enough for the precision you want. OIG's Self-Disclosure Protocol requires a minimum of 100 items if sampling is used, calculates damages from the mean point estimate, and does not allow underpayments to offset overpayments.
Generates random numbers, sizes samples and computes point estimates and confidence intervals. Using it (or an equivalent documented method) lets you present an extrapolation the government recognizes. Medicare contractors' own extrapolations must follow the Program Integrity Manual, chapter 8, which requires a statistically valid sample and permits a challenge to the methodology on appeal.
Many CIAs require a full sample and extrapolated repayment when the net financial error rate reaches 5%. Medicare's TPE program gives providers up to three rounds to get below the contractor's error threshold. Inside your own program, pick a threshold, document it and apply it the same way every time.
An audit finding is the moment the organization "identifies" an overpayment for 60-day purposes, or at least the moment it is on notice that related overpayments are likely. That is not a reason to avoid audits; an organization that does not look is in reckless disregard. It is a reason to have the quantification, refund and disclosure workflow ready before the audit report is issued, and to document the investigation if the 180-day suspension is needed.
The elements that do not involve a calculator are the ones that decide whether the others work. Staff report when they trust the process; they learn when training is specific to their work; evidence exists when retention is planned; and the program adapts when someone is watching what enforcement is doing this year.
A hotline or web form run by a third party, the compliance officer's direct line, managers, HR, and a way to report to the board. Post the options where billing staff work. Acknowledge every report, investigate within a defined period, and tell the reporter the outcome to the extent you can. Track volume: a hotline with no calls in a 500-person organization means people do not trust it.
An employee, contractor or agent who is fired, demoted, harassed or otherwise discriminated against for lawful acts in furtherance of an FCA action, or for efforts to stop an FCA violation, can sue for reinstatement, double back pay with interest and special damages. The claim stands even if the underlying FCA allegation fails. State whistleblower laws add parallel claims. Managers must know that a complaint about billing changes how any later adverse action will be read.
Triage within days; decide early whether counsel should direct the investigation for privilege; interview with two people present; preserve records (a litigation hold if the matter could become a government inquiry); conclude with findings, a quantification if money is involved and corrective action. Close the loop with the reporter.
Staff can report directly to OIG at any time, and OIG's Spring 2026 semiannual report notes hotline complaints continue to feed investigations. Internal reporting is not a condition of a qui tam suit. The only way to keep concerns inside is to resolve them.
| Audience | Content | Cadence and evidence |
|---|---|---|
| Everyone | Code of conduct, how to report, non-retaliation, privacy basics, the FCA in plain language, gifts and inducements | At hire (within 30 to 90 days is common) and annually; completion log by name and date |
| Registration and patient access | Identity verification, MSP questionnaire, insurance capture, ABNs and other notices, financial assistance screening, HIPAA at the front desk | Annually and at system changes; quality audits as the test |
| Coders and CDI | Annual code set updates, E/M rules, NCCI, modifiers, incident-to and split/shared, teaching physician, query compliance, specialty-specific rules | Annually with competency testing; accuracy audits as the ongoing measure |
| Billing and A/R staff | Edit handling, modifier authority, corrected claims, credit balances and refunds, the 60-day rule, payer audit responses, FDCPA for collections staff | Annually; edit override and credit balance metrics as the measure |
| Physicians and NPPs | Documentation that supports the level and the service, signature and attestation rules, cloning, time documentation, their own billing data versus peers | At onboarding and annually; audit results delivered one-to-one |
| Leaders and board | Program structure, enforcement trends, the organization's risk assessment and audit results, their oversight duties | Annually; minutes record it |
| Contracting and finance | AKS and Stark basics, FMV documentation, contract execution rules, discount reporting | Annually and before any physician deal |
No single rule covers everything. Keep the longest period that applies, and remember that the False Claims Act can reach back ten years, so the evidence that a claim was proper should be kept at least that long for federal program claims.
| Record | Minimum period | Authority |
|---|---|---|
| HIPAA policies, risk analyses, BAAs, training, sanctions, access logs | 6 years | 45 CFR 164.316(b)(2) and 164.530(j), from creation or last effective date |
| Documentation supporting items ordered, certified or referred for Medicare (DME, home health, lab, imaging) | 7 years | 42 CFR 424.516(f), from the date of service |
| Hospital medical records (Medicare CoP) | 5 years | 42 CFR 482.24(b)(1); state law often longer (many 7 to 10 years, longer for minors) |
| Medicare Advantage and Part D records (including contracted providers' records of services to enrollees) | 10 years | 42 CFR 422.504(d) and 423.505(d) |
| Cost report supporting data | 5 years after final settlement (common practice) | 42 CFR 413.20 requires records adequate for cost reporting; settled reports can be reopened for 3 years (42 CFR 405.1885), and FCA exposure runs longer |
| Claims, remittances, refund and overpayment files, compliance logs, exclusion screening evidence | 10 years recommended | FCA limitation outer limit (31 U.S.C. 3731(b)); the 6-year lookback for overpayments |
| Physician arrangements, FMV support, signed agreements | Term plus 10 years | Stark and AKS exposure persists for claims submitted during the term; FCA limitations |
The top DOJ priority. Medicare Advantage diagnosis coding, one-way chart reviews, and the OIG MA ICPG (February 3, 2026) that pushes plan compliance obligations down to the providers and vendors who code for them. Providers in capitated and risk-sharing arrangements are inside the target.
Wound care and skin substitute schemes dominated the June 23, 2026 National Health Care Fraud Takedown (455 defendants, $6.5 billion in alleged fraud, 90 licensed professionals). DME, genetic testing, telemedicine marketing and lab arrangements remain the recurring fact patterns.
The working group named "manipulation of electronic health record systems to drive inappropriate utilization." Templates, order sets, alerts and AI tools that increase billing without clinical basis are now a stated theory of liability.
Contractors and grantees that certify security compliance falsely face FCA suits; the same logic is beginning to reach health care entities that attest to security standards in federal contracts and grants.
OIG's Spring 2026 semiannual report (October 2025 to March 2026) reported $5.56 billion in expected savings and recoveries, 317 criminal actions, 287 civil actions and 1,212 exclusions in six months, and a return of $12.70 for each dollar of its budget. Exclusion volume is why monthly screening matters.
DOJ's cooperation credit, OIG's SDP terms and the 2025 "identified" standard all reward organizations that find, quantify and return. The cheapest FCA case is the one that became a refund letter in week six.
The statutes and regulations below are the ones a revenue cycle compliance program is built on. Citations are to the United States Code and the Code of Federal Regulations as in effect in October 2026.
Liability for knowingly presenting or causing a false claim, making a false record material to a claim, or knowingly retaining an overpayment (reverse false claims). Treble damages, reduced to double for timely cooperation; civil penalties of $14,308 to $28,619 per claim (DOJ 2025 adjustment, 28 CFR 85.5, unchanged for 2026). Qui tam provisions (3730(b)), relator shares (3730(d)), anti-retaliation (3730(h)), limitations (3731(b)). Civil investigative demands under 3733.
Criminal prohibition on remuneration to induce or reward federal program referrals; felony with up to 10 years and $100,000 per violation; claims resulting from a violation are false claims (1320a-7b(g)); no specific intent required (1320a-7b(h)). Safe harbors at 42 CFR 1001.952(a) through (jj), including the 2020 value-based, patient engagement, cybersecurity and outcomes-based payment provisions. OIG advisory opinions under 42 CFR Part 1008.
Prohibits physician referrals of Medicare designated health services to entities with which the physician or an immediate family member has a financial relationship, and billing for them, unless an exception applies. Definitions at 411.351 (DHS, referral, fair market value, commercially reasonable), general exceptions at 411.355, ownership exceptions at 411.356, compensation exceptions at 411.357, including value-based arrangements (411.357(aa)) and limited remuneration (411.357(z), $6,237 for 2026). Medicaid analog at 1903(s) of the Social Security Act. CMS Self-Referral Disclosure Protocol under section 6409 of the Affordable Care Act.
OIG authority to impose penalties, assessments and exclusion for false claims, excluded-person claims, kickbacks, beneficiary inducements, gainsharing payments, Stark claims, failure to report and return overpayments, and other conduct. Current amounts in the HHS inflation adjustment effective January 28, 2026 (45 CFR 102.3); no 2026 adjustment per OMB M-26-11.
Mandatory exclusion (minimum five years) for program-related crimes, patient abuse, felony health care fraud and felony controlled-substance convictions; permissive exclusion for the grounds in 1320a-7(b). Effect of exclusion at 42 CFR 1001.1901; reinstatement at 1001.3001–3005. OIG Special Advisory Bulletin on the Effect of Exclusion (updated May 2013). State Medicaid screening of owners and managing employees monthly under 42 CFR 455.436.
Report and return within 60 days of identification or the cost report due date, whichever is later. "Identified" means knowingly (FCA standard) under the CY 2025 Physician Fee Schedule final rule, effective January 1, 2025, with a suspension of up to 180 days for a good-faith investigation of related overpayments and a six-year lookback. Suspended while an OIG SDP or CMS SRDP submission is pending. Medicare Advantage and Part D at 42 CFR 422.326 and 423.360.
Permitted payment uses (164.506), minimum necessary (164.502(b)), business associate contracts (164.504(e)), individual rights (164.520–164.528), the Security Rule (164.302–164.318) and breach notification (164.400–164.414). Enforcement and penalty tiers at 45 CFR 160.404. Security Rule NPRM of January 6, 2025 (90 FR 898) pending, with final action listed for July 2027. Reproductive health care privacy rule (2024) vacated June 18, 2025.
Plans must operate an effective compliance program with the seven elements and apply it to first-tier, downstream and related entities, which includes contracted provider groups and vendors. OIG's Medicare Advantage ICPG (February 3, 2026) describes the risk areas plans will push into contracts: risk adjustment, access to care and prior authorization, marketing and enrollment, quality, third-party oversight and vertically integrated structures.
Incident-to services and direct supervision (410.26); split or shared visits and the substantive-portion rule with modifier FS (415.140); teaching physician presence, with virtual presence made permanent for CY 2026 (415.172). The CY 2026 Physician Fee Schedule final rule (released October 31, 2025) also set the conversion factors ($33.57 for qualifying APM participants, $33.40 otherwise) and a −2.5% efficiency adjustment to the work RVUs of non-time-based services. NCCI edits and MUEs govern bundling.
Defines an effective compliance and ethics program for sentencing credit and informs DOJ's Evaluation of Corporate Compliance Programs (design, good-faith application, effectiveness in practice). The DOJ Civil Division's June 2025 enforcement priorities memo and the July 2, 2025 DOJ-HHS False Claims Act Working Group announcement set the health care FCA agenda.
About thirty states and several cities have false claims acts, most with qui tam provisions, and the Deficit Reduction Act of 2005 rewards states whose statutes mirror the federal FCA (and requires large Medicaid providers to educate employees about them). State anti-kickback and self-referral laws often reach all payers, not only government programs. State breach laws, medical record retention periods, and Medicaid managed care contract compliance requirements add to the federal rules.
Medicaid provider screening, enrollment, disclosure of ownership and payment suspension on credible allegations of fraud (455.23). The Program Integrity Manual governs MAC, UPIC, RAC and SMRC medical review, including chapter 8's statistical sampling and extrapolation requirements and the Targeted Probe and Educate process.
| Item | Figure | Context |
|---|---|---|
| False Claims Act | ||
| Civil penalty per false claim | $14,308 – $28,619 | DOJ 2025 adjustment; no 2026 adjustment (OMB M-26-11) |
| Damages multiplier | 3× (2× with cooperation) | 31 U.S.C. 3729(a) |
| Relator share | 15–25% / 25–30% | Government intervenes / declines |
| Statute of limitations | 6 yrs; 3 yrs from knowledge; 10 yrs cap | 31 U.S.C. 3731(b) |
| FY2025 recoveries | $6.8 billion | $5.7 billion health care; record |
| FY2025 qui tam filings | 1,297 | Record; 401 government-initiated matters |
| Anti-Kickback and Stark | ||
| AKS criminal penalty | 10 years / $100,000 | Per violation; felony |
| AKS civil monetary penalty | $127,973 + 3× remuneration | 42 CFR 1003.310; 2025 amount in effect |
| Stark CMP per prohibited service | $31,670 | Circumvention scheme: $211,146 |
| Stark non-monetary compensation limit | $535 | CY 2026; medical staff incidental benefits under $46 per occurrence |
| Stark limited remuneration to a physician | $6,237 | CY 2026 |
| Nominal value gifts to beneficiaries | $15 / $75 | Per item / per patient per year (OIG policy) |
| Civil monetary penalties and exclusion | ||
| False claim or excluded-person claim CMP | $25,595 per item | Plus up to 3× assessment; effective Jan 28, 2026 |
| Mandatory exclusion minimum | 5 years | 42 U.S.C. 1320a-7(a) |
| Recommended screening cadence | Monthly | LEIE updated monthly; state Medicaid rule 42 CFR 455.436 |
| OIG exclusions, Oct 2025 – Mar 2026 | 1,212 | Spring 2026 semiannual report |
| Overpayments and disclosure | ||
| Report and return deadline | 60 days | From identification (knowing standard since Jan 1, 2025) |
| Investigation suspension (Parts A and B) | Up to 180 days | Good-faith investigation of related overpayments |
| Lookback | 6 years | 42 CFR 401.305(f) |
| OIG SDP minimum settlement | $100,000 / $20,000 | Kickback matters / other; 1.5× damages; 100-item minimum sample |
| SDP damages calculation due | 90 days | After initial submission |
| HIPAA | ||
| Breach notification | 60 days | Individuals; HHS and media at 500+ |
| Civil penalty per violation | $145 – $2,190,294 | Four tiers; annual cap $2,190,294 |
| Security Rule final rule | July 2027 (agenda) | NPRM Jan 6, 2025; current rule governs |
| Access request response | 30 days | One 30-day extension |
| Enforcement 2026 | ||
| 2026 National Health Care Fraud Takedown | 455 defendants / $6.5 billion | June 23, 2026; 90 licensed professionals; 295 Medicaid defendants |
| OIG expected savings and recoveries, Oct 2025 – Mar 2026 | $5.56 billion | 317 criminal, 287 civil actions |
| MFCU results, FY2025 | 1,185 convictions / $2 billion+ | State Medicaid Fraud Control Units |
The 60-day rule now runs from knowledge (since January 1, 2025); OIG's Medicare Advantage guidance (February 3, 2026) is flowing into plan contracts; CMP and FCA penalty amounts are frozen at 2025 levels for 2026.
Final action on the Security Rule overhaul is listed for July 2027 and would make encryption, MFA, asset inventories and 72-hour recovery mandatory. Expect penalty amounts to jump in early 2027 when a two-year catch-up adjustment is likely.
Managed care, EHR-driven utilization and product kickbacks lead DOJ's list. The remaining constitutional challenges to qui tam go back to the district court after the Eleventh Circuit's September 1, 2026 ruling; qui tam filings continue at record pace.
Eight questions drawn from the chapters above. Pick an answer to see the explanation.
For training and reference. This page summarizes general rules and does not replace payer contracts, plan documents, CMS manuals, state law or legal advice. The exposure illustrator and screener are teaching models, not legal assessments. Example names, IDs, amounts and payers are fictional.
Figures checked October 15, 2026.