6.4 Recognizing & Responding to Violations of Medical Law

Key Takeaways

  • The billing office sees patterns no clinician sees, which is why the Detailed Test Plan makes recognizing and responding to violations a distinct job task rather than a subset of compliance training.
  • Recognizable billing red flags include services documented but not performed, systematic upcoding, cloned documentation, routine unbundling modifiers, waived cost-sharing, and pressure to bill before documentation exists.
  • The correct first response is internal: document the concern in writing, escalate to the compliance officer through the established channel, and preserve the underlying records without altering them.
  • A specialist who is directed to submit a claim they know to be false may not submit it, because knowingly presenting a false claim creates personal liability regardless of who gave the instruction.
  • The False Claims Act anti-retaliation provision protects employees who investigate or report suspected fraud, entitling a retaliated employee to reinstatement, double back pay, interest, and special damages.
Last updated: August 2026

6.4 Recognizing & Responding to Violations of Medical Law

The second task in the Law and Ethics category is "Recognize and respond to violations of medical law." It sits between the scope-of-practice task and the fraud-and-abuse statutes because it is where the statutes meet the specialist's actual desk. Knowing what the False Claims Act prohibits is knowledge. Recognizing that the claim in front of you violates it, and knowing what to do next, is the job.

The billing office occupies a unique position: it sees patterns across providers and across time that no individual clinician sees. A physician knows their own notes. A coder auditing 200 charts knows that one provider bills a high-complexity visit 94% of the time while their partners bill it 31% of the time.


1. The Red Flags a Billing Specialist Can Actually See

Red FlagWhat It Looks Like at the DeskStatute Implicated
Services not renderedA charge with no corresponding note; a note for a patient who cancelled; recurring charges on dates the provider was awayFalse Claims Act
UpcodingOne provider's level distribution far outside their peers'; a level unchanged across every patient regardless of complexityFCA; CMP Law
UnbundlingModifier -59 or an X{EPSU} modifier appended as a routine step to clear edits, without documentation of a distinct serviceFCA; NCCI
Cloned documentationIdentical narrative across encounters and across patientsFCA — the note cannot prove the work
Modifier -25 on nearly every E/MAn E/M billed with a minor procedure at every visitFCA; a standing OIG Work Plan item
Routine cost-sharing waiverCopays never collected; "insurance only" balances written offAnti-Kickback Statute; CMP Law
Referral-linked moneyRent, medical directorships, or speaking fees paid to high-referring physiciansAnti-Kickback Statute; Stark Law
Self-referral to an owned entityIn-house imaging or lab owned by the referring physicians without a documented exceptionStark Law (strict liability)
BackdatingDates of service changed to fall inside a benefit period or a filing limitFCA
Retained overpaymentsCredit balances aging past 60 days without refundACA 60-day rule → reverse false claim
Billing before documentationInstruction to drop the claim now and "the note will follow"FCA — the claim asserts what the record does not yet support
Signature irregularitiesNotes signed by someone other than the rendering provider; stamped signaturesFCA; conditions of payment

The distinction to keep straight. A red flag is not a finding. Most anomalies have innocent explanations — a provider whose panel genuinely skews complex, a specialty where a modifier legitimately recurs. The specialist's obligation is to surface the anomaly through the proper channel, not to adjudicate it.


2. The Internal Response Ladder

The response sequence is tested because doing steps out of order can destroy both the investigation and the specialist's own protection.

1. STOP  ──► Do not submit the claim you believe is false. Hold it.
2. DOCUMENT ──► Write down what you observed: date, claim, patient account,
                what the record shows, what the claim asserts. Facts, not conclusions.
3. PRESERVE ──► Do not alter, delete, or "clean up" any record. Do not remove
                originals from the practice.
4. ESCALATE ──► Report through the compliance channel: compliance officer,
                hotline, or supervisor if neither exists.
5. COOPERATE ──► Support the internal investigation; provide data as requested.
6. FOLLOW UP ──► If nothing happens, escalate to the next level. Silence is
                 not resolution.

Why Each Step Matters

  • Stop. Submitting a claim you know to be false makes you a person who knowingly presented it. The FCA's scienter standard reaches actual knowledge, deliberate ignorance, and reckless disregard — and it does not exempt someone who was told to do it.
  • Document contemporaneously. A dated, factual, written record made at the time is evidence. A recollection assembled months later is a story.
  • Preserve. Altering or deleting records converts a billing problem into obstruction. Equally, removing original records or bulk-copying patient files to build a personal case is itself a HIPAA violation, however sympathetic the motive.
  • Escalate through the channel. Element 4 of the OIG's seven core elements requires a confidential reporting mechanism with a non-retaliation policy. Using it is what makes the practice's compliance program work and what documents that you acted.
  • Follow up. If a report goes nowhere, the escalation continues — to the compliance committee, to the governing body, and only after that to external channels.

3. What to Do When You Are Instructed to Submit It Anyway

This is the scenario NCCT builds items around, because it is the one that actually happens.

You may not submit a claim you know to be false, regardless of who instructs you.

A direction from a supervisor, an office manager, or the physician owner is not a defense. The FCA imposes liability on any person who knowingly presents or causes to be presented a false claim. "I was told to" does not negate knowledge; in some cases it establishes it.

The professional response is to decline in writing and escalate: state factually that the claim as constructed is not supported by the documentation, identify the specific defect, propose the correction, and route the concern to the compliance officer. Practically, that reads as "I can't submit this as coded — the note documents a level 3 and the charge is a level 5. I've held the claim and sent it back for review, and I've notified compliance."

Anti-Retaliation Protection

The False Claims Act at 31 U.S.C. § 3730(h) prohibits an employer from discharging, demoting, suspending, threatening, harassing, or otherwise discriminating against an employee because of lawful acts done in furtherance of an FCA action — which expressly includes investigating and reporting suspected fraud, whether or not a lawsuit is ever filed. A retaliated employee is entitled to reinstatement with seniority, two times back pay with interest, and compensation for special damages including litigation costs and attorney fees.


4. External Reporting: The Channels and Their Limits

Internal escalation is the first path, but it is not the only one.

ChannelFor WhatNotes
HHS OIG HotlineFraud, waste, and abuse in HHS programsAccepts anonymous reports
CMS / the MACImproper Medicare billing; voluntary overpayment refundsThe route for self-disclosure of identified overpayments
OIG Self-Disclosure ProtocolThe practice's own conductUsed by the entity, not the employee; can substantially reduce penalties
State Medicaid Fraud Control UnitMedicaid-specific fraud and patient abuseEvery state operates one
HHS OCRHIPAA privacy and security violationsSeparate from billing fraud channels
Qui tam actionFCA claims filed on the government's behalfFiled under seal by counsel; relator receives 15-25% if the government intervenes, 25-30% if it does not

The privacy limit on whistleblowing. An employee raising a fraud concern still owes HIPAA duties. Disclose the minimum necessary PHI to the appropriate authority for that purpose; do not copy entire patient files, do not take records home, and do not post anything publicly. A meritorious fraud report accompanied by an indiscriminate PHI disclosure creates a second violation with the reporter's own name on it.


5. A Worked Scenario

A coder notices that one physician bills CPT 99215 for 91% of established-patient visits, while three partners in the same specialty bill it for 28% to 34%. Spot-checking six charts, the coder finds that the assessment and plan in all six are byte-identical apart from the patient name, and the documented decision making supports a level 3.

StepCorrect ActionWrong Action
1Hold the unsubmitted claims from this provider pending reviewSubmit them and "flag it later"
2Write a dated memo: the level distribution, the six account numbers, what the notes document, what was billedConfront the physician in the hallway
3Leave the notes exactly as they areAsk the physician to "add detail" to the existing notes
4Deliver the memo to the compliance officer through the established channelPost about it; email it outside the practice
5Support the expanded audit; help quantify the exposureDecide alone how far back the problem goes
6Verify that identified overpayments are refunded within 60 days of quantificationAssume someone else is tracking the clock

Step 3 deserves emphasis. Asking a provider to supplement documentation after a claim has been submitted, in order to support what was already billed, is not a correction — it is the creation of evidence, and it converts a coding error into a far more serious matter. Legitimate late entries are permitted, but they must be identified as late entries, dated the date they were actually written, and signed.

Test Your Knowledge

A billing specialist is instructed by the office manager to submit a claim at a level the documentation clearly does not support. What is the correct action?

A
B
C
D
Test Your Knowledge

After discovering that a provider's notes appear cloned, a coder considers asking the provider to add detail to those already-submitted notes so they will support the level billed. Why is this wrong?

A
B
C
D
Test Your Knowledge

An employee is demoted after reporting suspected upcoding to the practice's compliance officer, even though no lawsuit was ever filed. What protection applies?

A
B
C
D