Compliance, Fraud, and Abuse in Medical Coding

Why Compliance Matters in Medical Coding

Medical billing and coding is not just a clerical task — it is a legal act. Every code submitted to an insurance payer or government program is a claim for payment. Submitting an inaccurate claim, whether intentionally or carelessly, can harm patients, waste public healthcare funds, and expose a medical practice to serious legal penalties. As a medical assistant, you may assign codes, review superbills, or process claims. Understanding fraud, abuse, and compliance protects your patients, your employer, and your own career.

Defining Fraud and Abuse

Fraud is an intentional act of deception to obtain payment that a provider is not entitled to receive. The person committing fraud knows the claim is false or acts with reckless disregard for the truth. An example is deliberately billing for a procedure that was never performed.

Abuse refers to practices that are inconsistent with sound medical, business, or fiscal practices and that result in unnecessary costs to payers — but without the intent to deceive. An example is routinely billing a higher-level office visit code than the documentation supports, simply because a coder assumes the physician always performs comprehensive exams.

The distinction matters legally, but both create liability. Unintentional errors that are discovered and corrected promptly carry far less risk than patterns of repeated mistakes.

The False Claims Act

The False Claims Act (FCA) is a federal law that prohibits submitting false or fraudulent claims for payment to the federal government, including Medicare and Medicaid. The FCA covers not only outright lies but also claims submitted with deliberate ignorance of their accuracy. Penalties under the FCA can include substantial fines per false claim and exclusion from federal healthcare programs. The FCA also includes a qui tam provision: a private individual (a "whistleblower") who reports fraud may receive a portion of recovered funds.

Medical assistants are not exempt from FCA liability if they knowingly participate in fraudulent billing.

Common Compliance Risk Areas in a Physician Office

The Office of Inspector General (OIG) of the U.S. Department of Health and Human Services publishes guidance on compliance risks. Key risk areas for physician practices include:

• Upcoding: Billing a higher-level or more expensive code than the service actually documented. For example, billing a complex office visit (high-complexity medical decision-making) when the note supports only a low-complexity visit.
• Unbundling: Billing separate codes for services that should be reported together under a single bundled code. Coding systems such as CPT have rules about which services are already included within other codes.
• Billing for services not rendered: Submitting a claim for a procedure or visit that did not happen.
• Using a code before verifying documentation: Assigning a diagnosis or procedure code based on a superbill checkbox or verbal report without confirming that the provider's note supports it. If the documentation does not back up the code, the claim is unsupported.
• Duplicate billing: Submitting the same claim more than once for the same date of service and patient.
• Lack of medical necessity: Billing for services that are not medically necessary for the patient's documented condition.

The Medical Assistant's Ethical and Legal Obligations

Your scope of practice in coding includes only what you are trained and authorized to do in your work setting. You must never assign codes you are uncertain about without supervision, and you must always verify that documentation supports the code before it is submitted.

If you discover a billing error or suspect a compliance problem, you have both an ethical duty and, in many situations, a legal obligation to act:

1. Do not ignore it. Allowing a known error to be submitted — or remain uncorrected — can convert an accident into knowing fraud.

2. Follow your office's reporting procedure. Most compliant practices have a compliance officer or a designated reporting process. Use it.

3. Document your concern. Keep a record of what you observed and when you reported it.

4. Do not retaliate against, or fear retaliation from, reporting. Federal and many state laws protect employees who report suspected fraud in good faith. The FCA specifically prohibits retaliation against whistleblowers.

5. Never alter records or destroy documentation to cover a suspected error.

OIG Compliance Program Guidance

The OIG has published a Compliance Program Guidance for Individual and Small Group Physician Practices that recommends seven core elements of an effective compliance program, including written policies, education and training, a process for reporting concerns without fear of retaliation, and regular internal audits. Even small offices benefit from following this framework. As a medical assistant, familiarity with your office's compliance policies is part of your professional responsibility.

Safety Note

Coding compliance is a patient safety issue. Inaccurate diagnosis codes can follow a patient through their medical record, affect future treatment decisions, and influence insurance coverage. A fraudulent upcoding of a procedure can result in a patient being billed for a service they did not receive. Protecting the integrity of the medical record protects the patient.