Healthcare Fraud and Abuse Prevention Guide: False Claims Act, Stark Law, Anti-Kickback Statute, and Compliance Program Design

The Legal Framework

Three federal statutes form the core of healthcare fraud and abuse law: False Claims Act (31 U.S.C. § 3729): the primary civil enforcement tool; creates liability for anyone who knowingly submits a false or fraudulent claim to the federal government; key provisions: a "false claim" includes: a claim for a service not rendered; a claim with an incorrect diagnosis code; a claim with an incorrect procedure code; a claim that misrepresents the provider, patient, or service; a claim for a service that was not medically necessary; penalties: $13,946–$27,894 per false claim (adjusted annually for inflation) plus treble damages; the "knowingly" standard: actual knowledge of the falsity; deliberate ignorance; reckless disregard — does NOT require specific intent to defraud; qui tam provisions: private individuals (relators, or "whistleblowers") can file FCA lawsuits on behalf of the government; relators may receive 15–30% of recovery; most major healthcare FCA actions began as qui tam lawsuits filed by former employees; Stark Law (42 U.S.C. § 1395nn): prohibits physicians from referring patients for designated health services (DHS) to entities with which the physician has a financial relationship, unless an exception applies; DHS includes: laboratory services, physical therapy, occupational therapy, radiology, DME, home health, outpatient prescription drugs, hospital services, and others; the Stark Law is a strict liability statute — intent is irrelevant; if a financial relationship exists without an applicable exception, the referral is prohibited and claims submitted are improper; exceptions: physician services exception; in-office ancillary services exception (most commonly used by group practices — requires services be provided in the same building, billed by the group, and supervised by a group physician); employment exception; personal services exception; fair market value compensation; Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)): prohibits offering, paying, soliciting, or receiving anything of value to induce or reward referrals of federal healthcare program business; broadly written — applies to any remuneration that is intended to influence referrals; criminal statute — conviction can result in imprisonment up to 10 years; civil monetary penalties also apply; safe harbors: specific arrangements that satisfy the AKS if all safe harbor elements are met; commonly used safe harbors: employment, personal services, small entity investment interests, GPO arrangements, managed care, price reductions.

Common Compliance Risks

Understanding the most common healthcare fraud and abuse risks enables proactive compliance: Upcoding: billing a higher-complexity or higher-reimbursement code than the services documented; E&M upcoding (billing 99215 when documentation supports 99214) is consistently a top audit target; surgical procedure upcoding (billing a more complex procedure than performed); FCA and upcoding: systematic upcoding is a false claims violation — each overcoded claim is a separate FCA violation; Unbundling: billing separately for services that should be billed together under a single comprehensive code; NCCI edits identify bundled code pairs; billing unbundled codes that should be packaged is an FCA risk; Billing for services not rendered (phantom billing): billing for a patient visit that did not occur; billing for a procedure that was ordered but not performed; billing for services by a provider who was not present; this is the clearest form of healthcare fraud — no documentation defense is possible; Medical necessity issues: billing for services that were not medically necessary based on the patient's documented clinical condition; common in: diagnostic testing orders for unnecessary tests; admission to a higher level of care than required; frequency of services in excess of clinical need; Physician self-referral (Stark) violations: physician-owned ancillary services that don't meet an exception; compensation arrangements with employed or contracted physicians that don't meet fair market value; improperly structured space and equipment leases; lab or DME referrals from owner-physicians; Improper use of billing modifiers: using Modifier 25 to bill an E&M on the same day as a procedure without a separately identifiable service; using Modifier 59 to bypass NCCI edits without clinical justification; using Modifier 22 (increased procedural services) without documentation; Kickback arrangements: paying physicians for referrals disguised as speaking fees, consulting arrangements, or research grants; medical directorships that are not actually worked; free or below-market-value goods or services provided to referral sources.

Compliance Program Design

An effective compliance program is the primary defense against fraud and abuse liability — and demonstrates good faith in any enforcement action: OIG's 7 Elements of an Effective Compliance Program: Element 1 — Written standards and policies: written code of conduct; billing and coding policies; documentation standards; conflict of interest policies; response procedures for suspected violations; Element 2 — Compliance officer and committee: a designated compliance officer with authority and access to leadership; a compliance committee including representation from billing, clinical, legal, and administration; Element 3 — Training and education: annual compliance training for all staff; role-specific training (billers on coding rules, physicians on documentation requirements, managers on Stark/AKS requirements); new employee training; Element 4 — Effective communication and reporting: anonymous reporting mechanism (hotline, web form); non-retaliation policy protecting whistleblowers; open-door policy encouraging good-faith reporting; Element 5 — Auditing and monitoring: prospective audits: pre-billing review of documentation and coding; retrospective audits: review of submitted and paid claims against documentation; statistical sampling: random and targeted audits; audit frequency: at minimum annually, more frequently for high-risk areas; Element 6 — Enforcement and discipline: consistent, documented disciplinary action for violations; no tolerance for retaliation against compliance reporters; documentation of corrective actions taken; Element 7 — Response and correction: prompt investigation of identified issues; corrective action plan when violations are found; voluntary repayment when overpayments are identified; self-disclosure when appropriate; Practice size and compliance programs: large health systems maintain dedicated compliance departments; small practices can implement compliance with: a designated compliance officer (often the practice manager); a written compliance plan; annual coding audits; staff training records; an employee hotline or email address; even a basic compliance program demonstrates good faith.

OIG Work Plan and Audit Priorities

The OIG Work Plan signals where federal audit and enforcement attention will focus: What the OIG Work Plan is: the OIG (Office of Inspector General) publishes an annual Work Plan identifying the areas of Medicare and Medicaid spending it will audit during the coming year; the Work Plan is publicly available at oig.hhs.gov; review it annually to identify which billing practices and service types are under increased scrutiny; using Work Plan topics as the agenda for internal audits is a best practice; Recent and recurring Work Plan focus areas: E&M services: high-level E&M code utilization (99215, 99205); documentation adequacy for E&M services billed at the highest complexity levels; telehealth: medical necessity of telehealth services; appropriate use of telehealth modifiers and POS codes; audio-only telehealth coverage documentation; Evaluation and Management in various settings: hospital observation services; critical care billing; skilled nursing facility E&M; Specialty-specific targets: ophthalmology: anti-VEGF drug billing and waste documentation; home health: eligibility for home health services; DME: medical necessity for power wheelchairs, orthotics; laboratory: specimen validity testing unbundled from drug testing; chiropractic: maintenance care billed with AT modifier; Targeted probe and educate (TP&E): CMS MACs conduct Targeted Probe and Educate (TP&E) reviews, selecting claims from providers with high error rates for documentation review; providers with high TP&E error rates are placed on prepayment review; the TP&E process creates significant cash flow disruption; RAC (Recovery Audit Contractor) audits: RACs are private contractors paid a contingency fee to identify Medicare overpayments; RAC audits focus on high-dollar, high-volume services; claims selected by RACs must be defended with documentation; the RAC look-back period is generally 3 years.

Self-Disclosure and Voluntary Repayment

When a compliance audit reveals billing errors or potential violations, proper self-disclosure and repayment protect the organization from greater liability: 60-day repayment rule: the ACA created a statutory obligation to report and return Medicare and Medicaid overpayments within 60 days of identification; failure to repay a known overpayment within 60 days converts the overpayment into a false claim — creating FCA liability; the 60-day clock starts when the overpayment is "identified" — which triggers a good-faith obligation to investigate the scope; Voluntary self-disclosure paths: OIG Self-Disclosure Protocol (SDP): for potential violations of the Anti-Kickback Statute or other fraud and abuse statutes; submission to the OIG with a description of the conduct, the calculation of damages, and the proposed settlement amount; acceptance into the SDP typically results in a multiplier of 1.5x the overpayment (vs. 3x treble damages under FCA); CMS Self-Referral Disclosure Protocol (SRDP): for potential Stark Law violations; submission to CMS with description of the financial relationship, the referred services, and calculation of repayment amount; MAC or carrier direct repayment: for coding errors or documentation deficiencies that resulted in overpayments without an element of fraud; voluntary repayment to the MAC with a brief cover letter explaining the error; no SDP or SRDP needed when the issue is a billing mistake, not a potential fraud or kickback; Scope of repayment: when an audit identifies errors, the organization cannot simply repay the identified claims; the 60-day rule requires determining the full scope of the overpayment through statistical sampling and extrapolation; repaying only the claims you found without extrapolating to the full population of similar claims may not satisfy the legal obligation; Documentation of the compliance response: document the entire self-disclosure process: the date the issue was identified; the investigation conducted to determine scope; the calculation of overpayment; the repayment made; the corrective action implemented to prevent recurrence; this documentation is the evidence of good faith that mitigates penalties in any subsequent government inquiry.