Medical billing compliance: The laws and violations (+ Downloadable checklist)

Key takeaways

Medical billing compliance means submitting claims that follow federal law, state law, and the payer contracts you signed.

Four federal laws carry most of the risk: the False Claims Act, the Anti-Kickback Statute, the Stark Law, and HIPAA.

Upcoding, unbundling, duplicate and phantom billing, and medical-necessity misrepresentation are the patterns that trigger audits.

False Claims Act penalties run from $14,308 to $28,619 per claim, plus up to three times what the program lost.

The OIG’s seven compliance elements scale down to a solo practice, and the checklist below shows exactly how.

Medical billing compliance means billing only for what you did, documented as you did it, in the way federal law and payer contracts require. Get that right and an audit is paperwork. Get it wrong as a habit and it becomes an enforcement matter.

The Justice Department recovered more than $6.8 billion in False Claims Act settlements and judgments in the fiscal year ending September 30, 2025. Over $5.7 billion of that involved health care. Whistleblowers filed 1,297 of those cases, the most in a single year.

Those numbers are less frightening than they look. What gets prosecuted is almost always a pattern, and for an honest practice compliance is mostly documentation discipline. But not knowing a rule has never been a defense. This article is general guidance rather than legal advice, so have a healthcare attorney or a certified coder review your own billing.

The laws that govern medical billing

Four federal laws carry most of the billing risk for a small practice. Every state also has its own insurance fraud statute, which reaches private-payer claims that federal law does not touch.

False Claims Act

The False Claims Act is the law behind most billing cases. It prohibits knowingly presenting a false or fraudulent claim for payment to the federal government. “Knowingly” covers actual knowledge, deliberate ignorance, and reckless disregard, and no intent to defraud is required.

Each item or service billed counts as its own claim, so a coding habit multiplies quickly. The law also lets any employee, patient, or former partner sue on the government’s behalf for a share of the recovery.

Anti-Kickback Statute

The Anti-Kickback Statute makes it a felony to knowingly offer, pay, solicit, or receive anything of value in return for referrals of federally reimbursable business. Remuneration means anything of value, including cash, free rent, discounted equipment, or a cut of the fee.

This is the one that catches aesthetic practices with referral arrangements. A per-patient payment to a partner clinic is the classic problem, and a claim tainted by a kickback is also a false claim. Statutory exceptions and safe harbors exist, but protection only applies when an arrangement meets every condition.

Stark Law

The Stark Law bars a physician from referring designated health services payable by Medicare to certain entities. The bar applies where the physician or an immediate family member has a financial relationship with that entity, unless an exception applies. It is strict liability, so intent is irrelevant.

Designated health services include clinical laboratory work, physical therapy, imaging, and outpatient prescription drugs. A cosmetic-only practice rarely touches any of them. A hybrid practice adding physical therapy or lab work should check the rules before it refers.

HIPAA

HIPAA does two separate jobs in billing. The Privacy and Security Rules govern how protected health information, known as PHI, is stored and shared, and the Office for Civil Rights enforces them.

The Administrative Simplification rules set the required format and content for electronic claims and related transactions, and CMS enforces those. Submit claims electronically and you are a covered entity, so both sets apply to you.

The violations that trigger audits

These are the patterns payers and auditors watch for. Each has an innocent version and a deliberate version, and the documentation is what separates them.

• Upcoding. Billing a higher-paying code than the record supports. The everyday version is an evaluation and management level picked by habit rather than by what the note actually contains.
• Unbundling. Splitting a bundled service into its parts to collect more. CMS publishes National Correct Coding Initiative edits that pair codes which should not be billed together, and payers apply them automatically.
• Duplicate billing. Sending the same claim twice, usually a resubmission that should have gone out as a corrected claim. In a payer’s data it looks identical to deliberate double-dipping.
• Phantom billing. Billing for something that never happened. A no-show recorded as a visit and supplies that were never opened both land here.
• Medical-necessity misrepresentation. Coding an elective or cosmetic service as medically necessary. This is the biggest risk for practices that offer treatments both ways, and it gets its own section below.
• Incident-to and supervision errors. Billing work done by staff under a physician’s number when the supervision rules were not met. Medicare’s incident-to rules require direct supervision and a physician-established plan of care, and specifics vary by payer and state.

Billing cosmetic versus medical: The line hybrid practices walk

The same treatment can be a covered medical service or an uncovered cosmetic one, and the chart is what decides. Nothing about the treatment itself settles the question.

Medicare excludes cosmetic surgery, which it defines as any procedure aimed at improving appearance. The exceptions are prompt repair of an accidental injury and improvement of the function of a malformed body member. Separately, federal payment is limited to services that are reasonable and necessary for diagnosing or treating illness or injury. Commercial plans copy both ideas closely.

So the temptation is easy to describe. A patient wants a treatment you offer, their plan will not pay for the cosmetic version, and a payable diagnosis code exists. Choosing that code because it pays, rather than because the record supports it, is a false claim. It is also among the easiest things for an auditor to catch, because the note will not match.

Every row in that table comes down to the same rule. The documentation decides, and it has to exist before the claim goes out, not after a denial arrives.

Superbills carry the identical obligation. Because you do not file one yourself, a superbill can feel like lower stakes. It is a statement your patient submits to their insurer on the strength of your codes and signature. Inflated codes on one are still a false statement, and your patient carries the consequences alongside you.

Which leaves the conversation nobody enjoys having. Tell the patient before treatment which parts their plan may cover and which parts they pay for, and record that in writing. A patient who hears “we’ll code it so it goes through” is a patient who can report you later.

The OIG’s seven elements, scaled for a small practice

The Office of Inspector General, known as the OIG, published its General Compliance Program Guidance in November 2023. It applies to everyone in the health care industry and replaced the practice of issuing compliance guidance through the Federal Register. The guidance is voluntary, and it says small entities should right-size the seven elements rather than skip them.

The OIG’s own floor for a small entity is one risk assessment and one claims audit a year. The monthly sample of five to ten claims is our addition. Ten minutes a month catches a drifting coding habit while it is still a handful of claims.

Element seven is where a mistake becomes an exposure. Federal law requires you to report and return a Medicare or Medicaid overpayment within 60 days of identifying it. You have identified an overpayment once you knowingly received or retained it, using the False Claims Act’s knowledge standard. That standard includes deliberate ignorance and reckless disregard.

The clock can pause for up to 180 days while you investigate in good faith whether related overpayments exist. Keeping the money past the deadline creates False Claims Act liability by itself, separately from whatever caused the original error.

How Pabau supports billing compliance

No software makes a practice compliant. The seven elements above describe habits, not features. What a system can do is remove the failure points that come from re-typing the same information in three places.

Practice management software like Pabau keeps maintained CPT and ICD-10 catalogs built in. Codes get searched rather than remembered, or copied across from last year’s cheat sheet. Diagnoses on a claim populate automatically from the active Problems documented on the client’s record. That keeps the chart and the claim saying the same thing, which is exactly what an auditor checks.

Claims are validated before they leave, through our integration with the clearinghouse Claim.MD. Every claim then carries its own activity history covering submissions, corrections, and denials. Run a monthly self-audit, or field a payer question about a March claim. The answer sits on the record rather than in someone’s inbox.

Keep the chart and the claim saying the same thing

Pabau builds claims from documented client records, with maintained CPT and ICD-10 catalogs, pre-submission validation through Claim.MD, and a full activity history on every claim. That gives your self-audits and payer requests one place to start.

Book a demo

Conclusion

Compliance has a reputation as a brake on billing. It works the other way round. When the note supports every code you send, you can bill confidently for everything you actually did. An audit then becomes an afternoon of paperwork instead of a threat.

The trade-off worth remembering is that this only works in advance. A program assembled after a payer letter arrives buys you very little. Written down beforehand, the same program is a few hours of work and a monthly habit.

Start with the checklist above, name someone to own it, and put the first self-audit in the calendar. Book a demo to see how Pabau keeps documentation, coding, and claims on one record for practices billing insurance.

Continue your research

New to submitting claims at all? Medical claims clearinghouse explains how a claim travels from your practice to the payer and back.

Working a pile of denials? Denial management in healthcare gives you a five-step process for recovering the claims you already submitted.

Filling in claim forms by hand? CMS-1500 form walks through all 33 boxes and the entries that most often get a claim rejected.

Want fewer claims coming back? Clean claim covers the scrubbing checks that catch errors before a payer ever sees them.

Need the deadlines that go with the rules? Timely filing limits by payer lists the filing and appeal windows per payer.

Frequently asked questions