6.4 Recognizing & Responding to Violations of Medical Law
Key Takeaways
- The billing office sees patterns no clinician sees, which is why the Detailed Test Plan makes recognizing and responding to violations a distinct job task rather than a subset of compliance training.
- Recognizable billing red flags include services documented but not performed, systematic upcoding, cloned documentation, routine unbundling modifiers, waived cost-sharing, and pressure to bill before documentation exists.
- The correct first response is internal: document the concern in writing, escalate to the compliance officer through the established channel, and preserve the underlying records without altering them.
- A specialist who is directed to submit a claim they know to be false may not submit it, because knowingly presenting a false claim creates personal liability regardless of who gave the instruction.
- The False Claims Act anti-retaliation provision protects employees who investigate or report suspected fraud, entitling a retaliated employee to reinstatement, double back pay, interest, and special damages.
6.4 Recognizing & Responding to Violations of Medical Law
The second task in the Law and Ethics category is "Recognize and respond to violations of medical law." It sits between the scope-of-practice task and the fraud-and-abuse statutes because it is where the statutes meet the specialist's actual desk. Knowing what the False Claims Act prohibits is knowledge. Recognizing that the claim in front of you violates it, and knowing what to do next, is the job.
The billing office occupies a unique position: it sees patterns across providers and across time that no individual clinician sees. A physician knows their own notes. A coder auditing 200 charts knows that one provider bills a high-complexity visit 94% of the time while their partners bill it 31% of the time.
1. The Red Flags a Billing Specialist Can Actually See
| Red Flag | What It Looks Like at the Desk | Statute Implicated |
|---|---|---|
| Services not rendered | A charge with no corresponding note; a note for a patient who cancelled; recurring charges on dates the provider was away | False Claims Act |
| Upcoding | One provider's level distribution far outside their peers'; a level unchanged across every patient regardless of complexity | FCA; CMP Law |
| Unbundling | Modifier -59 or an X{EPSU} modifier appended as a routine step to clear edits, without documentation of a distinct service | FCA; NCCI |
| Cloned documentation | Identical narrative across encounters and across patients | FCA — the note cannot prove the work |
| Modifier -25 on nearly every E/M | An E/M billed with a minor procedure at every visit | FCA; a standing OIG Work Plan item |
| Routine cost-sharing waiver | Copays never collected; "insurance only" balances written off | Anti-Kickback Statute; CMP Law |
| Referral-linked money | Rent, medical directorships, or speaking fees paid to high-referring physicians | Anti-Kickback Statute; Stark Law |
| Self-referral to an owned entity | In-house imaging or lab owned by the referring physicians without a documented exception | Stark Law (strict liability) |
| Backdating | Dates of service changed to fall inside a benefit period or a filing limit | FCA |
| Retained overpayments | Credit balances aging past 60 days without refund | ACA 60-day rule → reverse false claim |
| Billing before documentation | Instruction to drop the claim now and "the note will follow" | FCA — the claim asserts what the record does not yet support |
| Signature irregularities | Notes signed by someone other than the rendering provider; stamped signatures | FCA; conditions of payment |
The distinction to keep straight. A red flag is not a finding. Most anomalies have innocent explanations — a provider whose panel genuinely skews complex, a specialty where a modifier legitimately recurs. The specialist's obligation is to surface the anomaly through the proper channel, not to adjudicate it.
2. The Internal Response Ladder
The response sequence is tested because doing steps out of order can destroy both the investigation and the specialist's own protection.
1. STOP ──► Do not submit the claim you believe is false. Hold it.
2. DOCUMENT ──► Write down what you observed: date, claim, patient account,
what the record shows, what the claim asserts. Facts, not conclusions.
3. PRESERVE ──► Do not alter, delete, or "clean up" any record. Do not remove
originals from the practice.
4. ESCALATE ──► Report through the compliance channel: compliance officer,
hotline, or supervisor if neither exists.
5. COOPERATE ──► Support the internal investigation; provide data as requested.
6. FOLLOW UP ──► If nothing happens, escalate to the next level. Silence is
not resolution.
Why Each Step Matters
- Stop. Submitting a claim you know to be false makes you a person who knowingly presented it. The FCA's scienter standard reaches actual knowledge, deliberate ignorance, and reckless disregard — and it does not exempt someone who was told to do it.
- Document contemporaneously. A dated, factual, written record made at the time is evidence. A recollection assembled months later is a story.
- Preserve. Altering or deleting records converts a billing problem into obstruction. Equally, removing original records or bulk-copying patient files to build a personal case is itself a HIPAA violation, however sympathetic the motive.
- Escalate through the channel. Element 4 of the OIG's seven core elements requires a confidential reporting mechanism with a non-retaliation policy. Using it is what makes the practice's compliance program work and what documents that you acted.
- Follow up. If a report goes nowhere, the escalation continues — to the compliance committee, to the governing body, and only after that to external channels.
3. What to Do When You Are Instructed to Submit It Anyway
This is the scenario NCCT builds items around, because it is the one that actually happens.
You may not submit a claim you know to be false, regardless of who instructs you.
A direction from a supervisor, an office manager, or the physician owner is not a defense. The FCA imposes liability on any person who knowingly presents or causes to be presented a false claim. "I was told to" does not negate knowledge; in some cases it establishes it.
The professional response is to decline in writing and escalate: state factually that the claim as constructed is not supported by the documentation, identify the specific defect, propose the correction, and route the concern to the compliance officer. Practically, that reads as "I can't submit this as coded — the note documents a level 3 and the charge is a level 5. I've held the claim and sent it back for review, and I've notified compliance."
Anti-Retaliation Protection
The False Claims Act at 31 U.S.C. § 3730(h) prohibits an employer from discharging, demoting, suspending, threatening, harassing, or otherwise discriminating against an employee because of lawful acts done in furtherance of an FCA action — which expressly includes investigating and reporting suspected fraud, whether or not a lawsuit is ever filed. A retaliated employee is entitled to reinstatement with seniority, two times back pay with interest, and compensation for special damages including litigation costs and attorney fees.
4. External Reporting: The Channels and Their Limits
Internal escalation is the first path, but it is not the only one.
| Channel | For What | Notes |
|---|---|---|
| HHS OIG Hotline | Fraud, waste, and abuse in HHS programs | Accepts anonymous reports |
| CMS / the MAC | Improper Medicare billing; voluntary overpayment refunds | The route for self-disclosure of identified overpayments |
| OIG Self-Disclosure Protocol | The practice's own conduct | Used by the entity, not the employee; can substantially reduce penalties |
| State Medicaid Fraud Control Unit | Medicaid-specific fraud and patient abuse | Every state operates one |
| HHS OCR | HIPAA privacy and security violations | Separate from billing fraud channels |
| Qui tam action | FCA claims filed on the government's behalf | Filed under seal by counsel; relator receives 15-25% if the government intervenes, 25-30% if it does not |
The privacy limit on whistleblowing. An employee raising a fraud concern still owes HIPAA duties. Disclose the minimum necessary PHI to the appropriate authority for that purpose; do not copy entire patient files, do not take records home, and do not post anything publicly. A meritorious fraud report accompanied by an indiscriminate PHI disclosure creates a second violation with the reporter's own name on it.
5. A Worked Scenario
A coder notices that one physician bills CPT 99215 for 91% of established-patient visits, while three partners in the same specialty bill it for 28% to 34%. Spot-checking six charts, the coder finds that the assessment and plan in all six are byte-identical apart from the patient name, and the documented decision making supports a level 3.
| Step | Correct Action | Wrong Action |
|---|---|---|
| 1 | Hold the unsubmitted claims from this provider pending review | Submit them and "flag it later" |
| 2 | Write a dated memo: the level distribution, the six account numbers, what the notes document, what was billed | Confront the physician in the hallway |
| 3 | Leave the notes exactly as they are | Ask the physician to "add detail" to the existing notes |
| 4 | Deliver the memo to the compliance officer through the established channel | Post about it; email it outside the practice |
| 5 | Support the expanded audit; help quantify the exposure | Decide alone how far back the problem goes |
| 6 | Verify that identified overpayments are refunded within 60 days of quantification | Assume someone else is tracking the clock |
Step 3 deserves emphasis. Asking a provider to supplement documentation after a claim has been submitted, in order to support what was already billed, is not a correction — it is the creation of evidence, and it converts a coding error into a far more serious matter. Legitimate late entries are permitted, but they must be identified as late entries, dated the date they were actually written, and signed.
A billing specialist is instructed by the office manager to submit a claim at a level the documentation clearly does not support. What is the correct action?
After discovering that a provider's notes appear cloned, a coder considers asking the provider to add detail to those already-submitted notes so they will support the level billed. Why is this wrong?
An employee is demoted after reporting suspected upcoding to the practice's compliance officer, even though no lawsuit was ever filed. What protection applies?