How to build a billing compliance program that holds up in an audit

A billing compliance program is the written, operating system a practice uses to prove its claims are accurate. The HHS Office of Inspector General defines it as 7 elements, and judges you against all 7 when it decides whether an error was a mistake or a violation.

The gap most practices don't see: the False Claims Act doesn't punish mistakes. It punishes actual knowledge, reckless disregard, or deliberate ignorance (31 U.S.C. 3729(b)(1)(A)). A compliance program is the only document that separates the first category from the other two. Without one, intent is argued by inference from the size of the error.

Here's what OIG actually expects, what it costs to ignore, and the order to build it in.

Key takeaways

• OIG's 7 elements are written policies, leadership oversight, training, communication channels, enforcement, auditing and monitoring, and corrective action. All 7 count.
• Check the exclusion database monthly. 42 CFR 455.436(c)(2) says "no less frequently than monthly," and the list updates by the 10th of every month.
• False Claims Act penalties run $14,308 to $28,619 per false claim, plus 3 times the government's damages.
• A statistically valid sample beats a full claim review. OIG uses the difference estimator specifically to give providers the benefit of the doubt.
• 77.17% of FY 2025 Medicaid improper payments came from insufficient documentation. Documentation is the exposure.
• A self-disclosure within 30 days of detection can cut damages from treble to double.

Who requires a billing compliance program?

No federal statute compels a small practice to run a formal program. The False Claims Act does, functionally. Its reach covers anyone who knowingly submits a false claim to Medicare or Medicaid, and "knowing" is read as knowledge, deliberate ignorance, or reckless disregard.

That reading has hardened. DOJ published its first department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy in March 2026, superseding every component-specific policy across all 93 U.S. Attorney's Offices except Antitrust. The old fixed 75% fine reduction for a qualifying self-disclosure is now a discretionary 50% to 75%.

OIG's enforcement follows the same logic. The 2026 Work Plan lists active audits on chronic care management, modifier 25 E/M services, inpatient neurostimulator implantation, hospital and outpatient department billing, and incident-to billing. Our 2026 OIG work plan breakdown lists each project with its announcement date.

Practices read the enforcement history wrong. OIG settled two Medicare Advantage matters for $674 million and pursued 287 civil False Claims Act actions in a single reporting period. Nobody at any of those organizations set out to commit fraud. They billed the way they'd always billed, and the documentation wasn't there.

What are the 7 elements of an effective compliance program?

OIG's November 2023 General Compliance Program Guidance defines them. A program missing an element is a program that doesn't exist in the government's eyes.

Four details in that 2023 update matter more than the headline:

Quality of care now belongs in the program. OIG added it to mitigate patient harm and False Claims Act liability simultaneously. If your policies only talk about money, they're behind the guidance.

The disclosure log has 7 required fields. Date received, the person or department responsible for review, investigation findings, corrective actions taken, policy or process changes, date resolved, and any disciplinary action. If your hotline log is a spreadsheet of calls, it doesn't meet the standard.

The reporting channel has to be independent. A hotline owned by the department that would be investigated is a channel the guidance doesn't credit. Web form, mailbox, or third-party service all work.

Training at orientation within 30 days is the pattern NY's Medicaid Inspector General expects, with progressive discipline and an annual program review. Our compliance resource hub collects the templates worth starting from.

How do you run monthly exclusion screening?

42 CFR 455.436(c)(2) requires checking the LEIE and the Excluded Parties List "no less frequently than monthly." This is the one element with a date attached, which makes it the easiest to fail and the hardest to defend.

The mechanics:

The Privacy Act blocks SSN distribution in the downloadable file, so identity verification has to go through the online search. Practically that means you keep a local CSV for bulk matching and use the online search to confirm anyone who hits.

How badly practices miss this: in OIG's evaluation of 12 Medicaid managed care entities, only 78.1% of providers used the LEIE at all. The Excluded Parties List System was 51.2%, state sanctions databases 44.4%, the Medicare Exclusions Database 32.4%, and the National Practitioner Data Bank 2.2%. Four of the 12 entities weren't checking monthly. The same evaluation found 42% of providers required prospective hires to sign an affidavit about exclusion status, which is the cheapest control on the list.

Exclusion screening shares its data with enrollment and credentialing, which is why our credentialing services team runs it as part of the same monthly cycle.

State Medicaid programs layer their own screening obligations on top of the federal ones, and those layers are moving. On April 23, 2026, the CMS Administrator asked state Medicaid directors to build 2-year provider revalidation strategies and submit them within 30 days. Texas submitted its strategy on June 5, 2026, and lets providers revalidate up to 180 days ahead of their due date. Miss the date in Texas and you're disenrolled from the state programs, with no payment for services rendered to members. Our Texas medical billing guide covers the state specifics.

How often should you audit claims, and how big a sample?

A statistically valid sample beats reviewing every claim, for cost and for defensibility. OIG reached that position deliberately and has said so publicly.

OIG uses the difference estimator, which produces an overpayment estimate lower than a 100% review would, because it credits the provider for uncertainty. OIG reduces its estimate further to account for claims that were canceled or refunded. Courts have repeatedly upheld statistical sampling as a valid basis for calculating overpayments, and providers retain the right to appeal individual claim determinations through the normal process.

Two rules that matter for how you design your own review:

The estimate applies only to the population you sampled from. Sample 400 claims from one payer and your estimate says something about that payer only.

OIG's Provider Self-Disclosure Protocol calls for simple random sampling unless you demonstrate a need for something else, with the mean point estimate reported at a 90% confidence level. Stratified sampling is permitted, and for a multi-specialty group it's usually better, because it lets you sample each service line at a meaningful rate.

The tooling is free. RAT-STATS, OIG's own statistical software, has been used for audit-related recoveries in the billions and is what OIG's own auditors use.

Sizing your cadence by exposure:

Targeted means risk-driven: the codes, providers, and payers where your own denial data shows clustering. OIG's guidance recommends that approach for practices without a mature program. Our forensic RCM audit guide covers how to build that targeted list from your own remittance data.

What does a billing audit finding actually cost?

Per false claim, the False Claims Act runs $14,308 to $28,619 plus 3 times the government's damages. Those figures come from 28 CFR 85.5 and apply to penalties assessed after July 3, 2025. DOJ held them flat for 2026, so the 2025 range is still the operative one. The math on a small error is where this becomes real.

The worked example everyone cites is United States v. Rogan. Two physicians referred services that violated Stark, the Anti-Kickback Statute, and the False Claims Act. The hospital submitted 1,822 claims worth $16,864,677.50. Trebled, that was $50,594,032.50. Civil penalties of $7,500 per claim added $13,665,000. Final judgment: $64,259,032.50.

The rest of the penalty stack:

Stark's strict liability standard is the one that surprises people. Proof of intent isn't required, and a claim submitted in violation of Stark or the Anti-Kickback Statute can independently be a false claim.

The escape valve is speed. Disclosing a violation within 30 days of detection can reduce damages from treble to double. DOJ's January 2026 resolution of a medically unnecessary home health case credited the company's self-disclosure, internal investigation, remediation, and compliance improvements, and it landed at a substantially reduced settlement.

The improper payment data shows the scale underneath the penalty math. Medicaid's FY 2025 rate was 6.12%, or $37.39B. The government-wide figure was $186B, up $24B in one year. Our FY 2025 improper payments analysis separates the documentation failures from the fraud allegations, which are very different problems.

What is the OIG auditing in 2026?

The 2026 Work Plan tells you where to look before an auditor does.

Chronic care management. An audit announced in March 2026 examines whether billed CCM met the requirement of 2 or more qualifying chronic conditions. A prior OIG review found Medicare overpaid for CCM, and a $14.9 million settlement for false CCM claims followed.

Modifier 25. Still the most persistent E/M compliance risk across physician billing.

Inpatient neurostimulator implantation. A March 2026 audit targets inpatient claims after a prior review found $636 million in overpayments. Prior authorization requirements apply to the outpatient procedures and not the inpatient ones.

Hospital and outpatient department billing. Emergency department levels, facility E/M coding, and device credits for implantable devices.

Incident-to billing. An active project testing whether services billed incident to a physician actually met Medicare requirements.

Virtual check-in and e-visit edits. OIG found improper payments where these services were billed too close to another E/M encounter and where modifiers didn't fit.

Place of service. Improper payment where emergency department procedure codes were billed with non-emergency POS codes.

What connects them is documentation. Every one of these is a claim that needed a record proving something specific, and the record wasn't there. Our medical billing audit service scopes that review against your actual claim volume rather than a generic checklist.

What does a compliance program actually return?

Here's the calculation I run with practices, because the penalty math only tells you the downside.

Error surface = (annual federal paid volume × your error rate) × the share no one is actively reviewing

Practices already have a working error rate. It's the denial rate. MGMA's DataDive puts single-specialty groups at 8% first-pass, and the Allscripts Practice Performance Database reports 16% across 5,729 organizations. HFMA calls below 5% optimal with 5% to 10% as the industry average. 86% of denials are considered potentially avoidable, per Change Healthcare data cited by MGMA, and roughly half originate in the front office.

Worked example. Take a practice paid $7.3M a year by Medicare and Medicaid. At a 6% error rate, that's $438,000 in rework, using MGMA's $25.20 average cost to rework a single claim. Now assume MAC medical review and payer edits already surface about half of that. The remaining $219,000 sits outside anyone's active review.

Run that through the False Claims Act multiplier and $219,000 of unreviewed exposure becomes a $657,000 number the day anyone characterizes it as knowing. That's the gap a compliance program closes.

For context on what recovery looks like, MGMA documented a primary care group with 57,600 annual encounters at $131 average revenue per encounter and a 14% initial denial rate. That produced 8,064 denied encounters worth just over $1 million. Rework cost roughly $353,000 at $43.84 per denial. At a 54% recovery rate the group recovered about $570,000, a net gain near $217,000. That group's problem was measurable. Most practices have never computed their version. Our clean claim rate benchmark shows you how to get the starting number, and the revenue integrity tool does the scoring.

What should you do in the first 90 days?

Days 1 through 30: name someone and pull the exclusion list. A compliance officer with actual authority, a committee with a written charter, and a monthly LEIE check running against the 10th-of-month update.

Days 31 through 60: write the policies. Start with the code of conduct and a claims-submission policy that states the practice bills only for services actually rendered and documented. The four OIG risk areas for physicians are coding and billing, reasonable and necessary services, documentation, and improper inducements. Cover all 4.

Days 61 through 90: run the first sample and open the channel. A statistically valid sample sized to your volume, plus a reporting channel that doesn't route back to the department under review. Log the results in the 7 fields OIG lists.

Then repeat on a calendar: monthly exclusion screening, quarterly sample reviews scaled to your volume, annual training and annual program review.

If you want the first sample run by someone who isn't your biller, request a free audit and we'll scope it against your actual claim data.