Medical Billing Compliance: OIG Program Elements for Practices

By Awais Afzal, Healthcare Operations & Data Analyst · Published February 23, 2026 · Updated October 14, 2026

Medical billing compliance means submitting accurate, supported claims and correcting mistakes quickly when they surface. In practice, that is a written program built on the seven elements in HHS-OIG guidance, regular claim audits, staff training, and a process to return Medicare overpayments within the 60-day deadline.

Most practices do not fail at medical billing compliance because of fraud. They fail because nobody owns it: coding habits drift, notes do not support the code, and a refund sits in a pile. This guide is for owners and practice managers deciding how to set up or tighten a program. It uses the HHS-OIG General Compliance Program Guidance, the eCFR text of the Medicare overpayment rule and OIG’s guidance for small physician practices. We last checked those sources on October 14, 2026. It replaces the earlier version of this post, which cited statistics we could not verify.

What medical billing compliance means for a practice

Medical billing compliance is the work of making sure every claim you send is accurate, supported by the record and consistent with the rules of the program or payer that receives it. It also covers what you do after a mistake: finding it, fixing it and returning money that was paid in error.

It is not the same as privacy and security. HIPAA governs how you protect patient information; our HIPAA compliance checklist for medical practices covers that side. Billing compliance is about the claim itself. The two programs share some habits, such as training and access control, but they answer different questions.

In OIG’s 2000 small-practice guidance, a billing review looks at coding accuracy, documentation, medical necessity and whether there is any incentive to provide unnecessary services (OIG, 2000). That is a good working scope for a first audit:

• Coding accuracy: the codes billed match the service documented.
• Documentation: the note supports what was billed, and it is signed and dated.
• Medical necessity: the record shows why the service was needed.
• Claim handling: errors are corrected, and payments made in error are returned.

Payer rules differ, so keep a short sheet of the differences for your billers.

The laws behind billing compliance

Five federal authorities explain most of the risk a billing office carries. OIG’s overview of fraud and abuse laws describes each one, and the table below summarizes them in plain terms.

Source: HHS-OIG, Fraud and Abuse Statutes, Administrative Authorities, and Self-Disclosures (undated).

The False Claims Act is the one billing teams meet most often, because a claim does not need to be part of a scheme to be a problem. For penalties assessed after July 3, 2025, the Department of Justice’s inflation adjustment sets the per-claim range at $14,308 to $28,619 (DOJ, Federal Register, July 3, 2025). Those amounts are adjusted for inflation, so check the current figure before you quote it internally.

One practical point follows from the Anti-Kickback and Stark rows: compliance is not only about codes. Marketing arrangements, referral relationships and anything of value that changes hands near a referral belong in the same review. If a billing issue also looks like a referral issue, bring in a health care attorney before you act. Intentional overcoding is a separate problem with its own risks; our guide to upcoding in medical billing explains how it differs from honest coding errors.

The seven elements of an effective compliance program

HHS-OIG’s General Compliance Program Guidance lists seven elements of an effective compliance program. OIG calls the guidance voluntary and says it is not binding on any individual or entity (HHS-OIG, 2023). It also has a section on how small entities can adapt the elements, which is the part most practices should read first.

Source: HHS-OIG, General Compliance Program Guidance (2023), element names. The billing-office examples are our suggestions, not OIG text.

Where a small practice can start

OIG’s 2000 guidance for small practices lists seven components of its own: internal monitoring and auditing, written standards, a designated compliance contact, training, responding to problems, open communication and disciplinary standards. It says a practice can begin with the components most likely to help, rather than adopting everything at once (OIG, 2000).

A reasonable first quarter is to name the compliance contact, write a one-page coding and documentation standard, and run the first audit. Training and a disclosure channel can follow. The order matters less than the habit of finishing each step and writing down what was done.

Not every audit looks the same. Internal reviews, outside coding audits and payer-run reviews have different triggers and different results; our overview of medical coding audit types compares them.

How to audit claims in a small practice

A workable audit is a small random sample of paid claims, checked against the note, repeated on a schedule. OIG’s 2000 small-practice guidance describes audits as periodic and at least once a year, with a baseline review of claims submitted and paid in the first three months after training (OIG, 2000).

For sample size, the same guidance gives a basic rule: five or more records per federal payer, such as Medicare or Medicaid, or five to ten records per physician. Larger samples give more confidence, and at a minimum practices should review claims paid by federal programs (OIG, 2000). It is guidance, not a legal threshold, so a practice with higher risk should sample more.

1. Pick the sample at random. Pull paid claims by payer and provider, then choose records without looking at the code first.
2. Compare the claim to the note. Check the code, the modifier, the diagnosis and the date of service against what is documented.
3. Check medical necessity. Ask whether the record shows why the service was needed.
4. Score and log the result. Record each error type and whether it caused an overpayment, an underpayment or no payment change.
5. Fix and retrain. Correct the claims, return any money owed, and train on the pattern you found.
6. Re-audit. Run the next sample after training to see whether the pattern changed.

Specialty changes what you sample. Surgical, therapy, infusion and behavioral services each carry their own code families and documentation habits, so the high-risk codes differ. The specialty billing pages show how we group those patterns, and our medical billing audits guide goes deeper on audit types and findings.

What to do when you find an overpayment

If you find a Medicare overpayment, report and return it by the later of 60 days after it was identified or the due date of any corresponding cost report. That deadline is in 42 CFR 401.305(b), and it applies to a person who has received an overpayment (eCFR, current text).

The rule says an overpayment is identified when a person knowingly receives or retains it, with “knowingly” defined by reference to the False Claims Act at 31 U.S.C. 3729(b)(1)(A). The eCFR source note shows the section was amended in December 2024 (89 FR 98553), so older summaries of the “identified” standard may be out of date. Read the current text, or ask counsel, before you rely on a summary.

The main points of the rule, as the current text reads:

• Deadline: the later of 60 days after identification, or the due date of any corresponding cost report.
• Investigation pause: the deadline is suspended while a timely, good-faith investigation looks for related overpayments from the same or a similar cause. The pause ends when the investigation concludes and the amount is calculated, or 180 days after the first identification, whichever is earlier.
• Other pauses: an acknowledged OIG or CMS self-disclosure submission, or a pending request for an extended repayment schedule.
• How to report: use the contractor’s process, such as a claims adjustment, credit balance or self-reported refund, and describe any sampling and extrapolation you used.
• Lookback: the rule applies if the overpayment is identified within 6 years of the date it was received.
• If you keep it: an overpayment retained past the deadline becomes an obligation under the False Claims Act, 31 U.S.C. 3729. Source: eCFR, 42 CFR 401.305.

OIG’s small-practice guidance takes a measured view of ordinary mistakes: erroneous claims that do not involve a violation of law generally result only in returning the funds claimed in error. It also points practices to the OIG Provider Self-Disclosure Protocol for suspected fraud, and says to keep records of both the problem and the response (OIG, 2000). Which path applies is a legal judgment, so involve counsel when the facts are unclear.

Payers can also start a review of their own. If you receive a records request or a recovery audit notice, our guide to RAC audits explains what that process looks like.

In-house, outsourced or hybrid: who runs the compliance work

Most small practices land on a hybrid: a named person inside the practice owns compliance, and an outside biller or auditor does part of the review. The right mix depends on staff time, volume and how much specialty coding you carry.

Whichever model you choose, the compliance contact stays accountable inside the practice. If you outsource, the vendor becomes part of your program, so ask questions before you sign:

• Will you sign a Business Associate Agreement before anyone sees patient data?
• How do you restrict access by role, and can you show an audit trail of who changed a claim?
• What credentials do your coders hold, and how are they trained on new code sets each year?
• How do you sample your own work, and how often do you share results with us?
• What is your process when you find an overpayment, and who tells us and by when?
• Who approves a code change that affects what the practice is paid?

If you are weighing outside help, see how medical billing services are structured and what a vendor should report back. Cleaner submissions also reduce rework; our clean claims guide covers how.

Software can support the process without replacing judgment. A claim-centred practice management system that tracks claims by stage can assign each claim an owner, run data-completeness checks before submission, flag payments that differ from the expected amount, and keep a role-based audit log. Those features help you prove who did what and when. They do not decide whether a note supports a code.

Our recommendations

1. Name one compliance owner and write it down. Pick a person, give them protected time, and record the appointment. A role nobody holds will not produce audits or refunds.
2. Start with a one-page standard. Write down who may change a code, what the note must show for your top services, and where questions go. Expand it after the first audit.
3. Schedule the first audit now. Use the OIG small-practice sample rule as a floor: at least five records per federal payer, or five to ten per physician. Put the date in a calendar.
4. Log every refund decision. For each possible overpayment, record the flag date, reviewer, decision and refund date. That record is your evidence if the 60-day clock is questioned.
5. Train on the errors you actually found. Use audit results to choose training topics, and record who attended. Generic training is easier to skip and harder to defend.
6. Review compensation and referral arrangements separately. Billing audits do not catch Anti-Kickback or Stark issues. Ask a health care attorney to review them when you change a contract or add a referral relationship.
7. Re-check the rules each year. Penalty amounts, code sets and payer policies change. Add a yearly review of your standard against current CMS and OIG sources.

Bottom line

Medical billing compliance is a set of habits, not a binder: one named owner, regular claim samples, training that follows the errors you find, and a refund routine that respects the 60-day clock. If you want help with the billing side, read how our revenue cycle management services are organized, or contact our team for a free practice audit.

Frequently asked questions

What is medical billing compliance?

It is the practice of sending accurate claims that the medical record supports, following the rules of each payer and federal program, and correcting mistakes promptly. It includes coding accuracy, documentation, medical necessity, audits, training and returning money paid in error. It is separate from HIPAA privacy and security, though the two programs can share staff and processes.

Does a small practice need a formal compliance program?

OIG describes its guidance as voluntary, and it includes a small-entity section. A practice does not have to adopt all seven elements at once. But some payer contracts or other obligations may require a program, so check your contracts and ask counsel. A small practice can start with a named owner, a written standard and a first audit.

How often should we audit our claims?

OIG’s 2000 small-practice guidance describes audits as periodic and at least once a year, starting with a baseline review of claims paid in the first three months after training. It is guidance, not a legal rule. Practices with higher volume, new providers or past errors should sample more often.

How many claims should we sample?

OIG’s small-practice guidance gives a basic rule of five or more records per federal payer, or five to ten per physician, selected at random. Larger samples give more confidence. If a sample finds errors, widen it to learn how far the problem goes before you decide on repayment.

How long do we have to return a Medicare overpayment?

Under 42 CFR 401.305, the deadline is the later of 60 days after the overpayment is identified or the due date of any corresponding cost report. The deadline can be suspended during a timely, good-faith investigation, which ends at the latest 180 days after the first identification. Ask counsel how the rule applies to your facts.

What happens if we keep an overpayment past the deadline?

The rule says an overpayment retained after the deadline becomes an obligation under the False Claims Act. That law provides for treble damages and per-claim penalties, which were $14,308 to $28,619 for penalties assessed after July 3, 2025. Return the money and document the steps rather than waiting to see if anyone asks.

Sources

1. General Compliance Program Guidance — HHS Office of Inspector General (2023)
2. OIG Compliance Program for Individual and Small Group Physician Practices — HHS Office of Inspector General (Federal Register, Oct. 5, 2000) (2000)
3. 42 CFR 401.305 Requirements for reporting and returning of overpayments — eCFR (2026)
4. Civil Monetary Penalties Inflation Adjustments for 2025 — Department of Justice (Federal Register) (2025)
5. Fraud and Abuse Statutes, Administrative Authorities, and Self-Disclosures — HHS Office of Inspector General