Regulatory Compliance and Fraud, Waste, and Abuse
The compliance frame
Healthcare billing is governed by HIPAA (privacy/security), False Claims Act (FCA), Anti-Kickback Statute (AKS), Stark Law (physician self-referral), Civil Monetary Penalties Law, and the Physician Payments Sunshine Act. Know the difference between fraud (intentional deception), waste (misuse without intent), and abuse (improper practices that may be unintentional but cause unnecessary cost).
Compliance programs include a code of conduct, policies and procedures, training, auditing and monitoring, hotline, and non-retaliation. Upcoding, unbundling, billing for services not rendered, and false documentation are classic violations. The OIG and DOJ enforce; qui tam actions allow whistleblowers to sue on the government's behalf.
Traps in questions
- Confusing fraud (intent) with abuse (no required intent) - questions often hinge on intent.
- Believing a compliance program is optional for small practices; it is expected and can mitigate penalties.
- Overlooking the AKS/Stark distinction: AKS targets remuneration for referrals; Stark targets physician self-referral for designated health services.
- Assuming internal audits are punitive - they are preventive.
Rule of thumb
When in doubt, document the medical necessity, follow written policy, and route concerns through the compliance hotline without fear of retaliation.
Worked example
A coder routinely selects a higher E/M level than documentation supports to increase revenue. This is upcoding - potentially fraud if intentional - and must be corrected through audit and education.