Billing compliance: the lines you never cross

Billing compliance is the discipline of ensuring every claim accurately reflects services actually rendered, properly documented, and correctly coded. The consequence of failure is not a billing correction — under the False Claims Act, it is treble damages plus per-claim penalties, brought by the government or by a former employee.

​

The prohibited patterns

​

Upcoding

Billing a higher-level or more expensive code than the service rendered and documented supports. Common shapes: routinely billing high-level evaluation and management codes regardless of complexity; billing a comprehensive service when a limited one was performed; selecting a diagnosis that supports higher payment rather than the one that reflects the patient’s condition. The test: does the documentation support the code? If a coder reading only the note would not arrive at that code, the code is wrong.

​

Unbundling

Billing separately for component services that should be billed under a single comprehensive code. CMS’s National Correct Coding Initiative (NCCI) publishes edits identifying code pairs that should not be reported together.¹ Overriding an NCCI edit with a modifier when the clinical circumstances don’t justify it is unbundling. Modifier 59 and its more specific X-modifiers are the ones to watch — they signal a distinct procedural service, and using them to bypass edits without a genuine clinical basis is a recognized enforcement pattern.

​

Incident-to abuse

Incident-to billing allows services performed by auxiliary personnel to be billed under a physician’s NPI at the physician’s rate when specific Medicare requirements are met, including direct supervision, an established plan of care, and the physician’s active involvement in the course of treatment.² Frequent failures: no supervising physician physically present when required; billing a new patient or a new problem incident-to; the supervising physician having no involvement in the patient’s care; billing incident-to for a service outside the auxiliary personnel’s scope of practice. Incident-to rules are Medicare-specific and commercial payers vary. Many practices apply the Medicare framework universally and are wrong in both directions, non-compliant with a commercial payer’s stricter rule, or leaving money on the table where a payer credentials the mid-level directly.

​

Documentation and signature failures

Services must be documented, and documentation must be authenticated by the rendering provider. Unsigned notes, notes signed by someone who did not perform the service, and cloned documentation copied between encounters are all findings. Copy-forward in EHRs is a specific risk: a note that says the patient reported the same symptoms in identical language across six visits does not evidence six distinct evaluations.

​

Medical necessity

The service must be reasonable and necessary for the diagnosis or treatment. Local coverage determinations (LCDs) from your MAC and national coverage determinations (NCDs) define this for Medicare, and commercial payers maintain their own medical policies. A service can be perfectly performed, correctly coded, and fully documented, and still not be payable because it isn’t covered for that indication.

​

Billing for services not rendered

The clearest violation. Includes billing for no-shows as if seen, billing for time not spent on time-based codes, and billing for a rendering provider who was not present.

​

The False Claims Act

The reason billing compliance carries the weight it does. The FCA, 31 U.S.C. §§ 3729–3733, prohibits knowingly submitting false or fraudulent claims to the government. “Knowingly” includes actual knowledge, deliberate ignorance, and reckless disregard — it does not require specific intent to defraud.³ Damages are trebled, plus a civil penalty per claim. Because healthcare bills claim-by-claim, a systematic coding error across two years produces a very large number of claims and a correspondingly large penalty exposure independent of the actual overpayment.

​

Qui tam

The FCA’s qui tam provisions let a private person, a relator, sue on the government’s behalf and share in the recovery. Relators in healthcare are most often current or former employees: billers, coders, practice managers, and clinicians. The suit is filed under seal while the government investigates whether to intervene. Two practical implications:

1. Your billing staff are the people most likely to become relators, because they see everything. A biller who raises a coding concern and is dismissed or ignored is the classic fact pattern.
2. Build a channel where concerns get heard and documented. A functioning internal reporting process is both a defense and the reason most concerns never become lawsuits.

​

The overpayment connection

Under 42 U.S.C. § 1320a-7k(d), an identified Medicare or Medicaid overpayment must be reported and returned within 60 days; retaining it creates FCA liability. CMS revised the identification standard effective January 1, 2025, replacing “reasonable diligence” with the FCA knowledge standard.⁴ The practical consequence: discovering a billing error starts a clock. See Report and return overpayments.

​

Who owns billing compliance in an MSO-PC group

The question the two-entity structure makes genuinely awkward, and the answer matters. The PC owns clinical and billing compliance. It renders the services, its clinicians document them, its NPI is on the claim, and it is the entity submitting claims. Compliance responsibility follows. The MSO staffs and systematizes it. The compliance officer, the auditors, the training program, and the monitoring tools are typically MSO-provided resources. The MSA should say who does what. Specifically: that the PC is responsible for the accuracy of coding and billing, that the MSO provides personnel and systems in support, and that clinicians retain authority to reject a coding change. California’s SB 351 and Oregon’s SB 951 both name billing and coding among the functions a management entity may not control⁵ — an MSO that directs coding has a CPOM problem layered on top of a billing compliance problem. This creates a structural tension worth naming: the MSO has the economic incentive to maximize collections and provides the staff who code, while the PC bears the compliance responsibility. The mitigations that work:

• The clinician can always reject a coding change, and that authority is documented
• Coding audits report to the PC, not only to MSO management
• Billing staff can escalate documentation concerns to a clinician without going through MSO operations
• Compensation for billing staff is not tied to collections in a way that rewards aggressive coding

​

A minimum viable program

Scaled to a small group:

1. Written policies on coding, documentation, and billing
2. Annual training for clinicians and billing staff
3. Periodic internal audits, a sample of charts per clinician per period, comparing documentation to codes
4. A reporting channel where concerns can be raised without retaliation, and a documented non-retaliation policy
5. Monthly exclusion screening, OIG LEIE and SAM.gov, documented
6. A response process for identified overpayments, aware of the 60-day clock
7. A designated compliance owner, a person, not a committee

The seven elements of an effective compliance program in OIG guidance are the fuller framework; the list above is the version a ten-person practice can actually run.⁶

​

Sources

1. CMS, National Correct Coding Initiative Edits.
2. Incident-to requirements: 42 C.F.R. § 410.26; CMS, Medicare Benefit Policy Manual, ch. 15.
3. False Claims Act, 31 U.S.C. §§ 3729–3733; scienter defined at § 3729(b)(1).
4. 42 U.S.C. § 1320a-7k(d); CMS-4205-F, published December 9, 2024, effective January 1, 2025. See Morgan Lewis, Tick-Tock: CMS Overpayment Refund Final Rule.
5. Cal. S.B. 351 (2025); Or. S.B. 951 (2025). See the legislation tracker.
6. HHS OIG, Compliance Program Guidance.