Medical Coding Fraud: Schemes, Laws, and Penalties

Medical coding fraud is the knowing manipulation of standardized billing codes to collect money from a health insurer, usually Medicare or Medicaid, that a provider is not owed. It is prosecuted under overlapping federal civil and criminal statutes, and the consequences can include treble damages, per-claim penalties between $14,308 and $28,619, prison sentences up to life, and permanent exclusion from federal healthcare programs. In fiscal year 2025, the Department of Justice recovered more than $5.7 billion in healthcare-related settlements and judgments under the False Claims Act alone.¹

What Separates Fraud From a Billing Mistake

Not every incorrect claim is a crime. Federal enforcement turns almost entirely on intent, and the government draws clear lines between four categories of conduct.

Fraud is the deliberate submission of claims a provider knows to be false. The statutory trigger is the word “knowingly.” Billing for a service that was never performed, or inflating the complexity of a routine visit to collect a higher reimbursement, is fraud.

Abuse covers practices that generate improper costs without a calculated intent to deceive. A provider who habitually orders unnecessary tests crosses into abuse. It still violates program rules and can produce financial penalties, but it doesn’t carry the criminal exposure of fraud.

Waste is inefficiency: redundant tests, failure to use cheaper alternatives, administrative sloppiness that costs the program money. Error is the clerical slip — the wrong code selected in good faith. Errors generally don’t trigger penalties, though overpayments still have to be returned.²

What converts a billing problem into a prosecutable case is proof that the provider acted knowingly. That single element decides whether a provider is writing a refund check or defending a federal indictment.

The Common Schemes

Healthcare billing runs on two main code sets: ICD-10 for diagnoses and CPT for services and procedures.³ Fraud schemes work by distorting what those codes tell the payer.

Upcoding

Upcoding is billing for a more complex or expensive service than the one actually delivered. A ten-minute follow-up submitted under a code for a comprehensive evaluation is the textbook example. The dollar difference between adjacent evaluation codes is substantial, and a single upcoded claim looks ordinary on paper. Auditors catch upcoding by comparing a practice’s code distribution to peers in the same specialty.

Unbundling

Certain services are supposed to be billed together under a single bundled code. Unbundling breaks them into separate line items so each pays independently, inflating the total reimbursement. CMS maintains the National Correct Coding Initiative to flag code combinations that shouldn’t appear separately on a claim.⁴

Phantom Billing

Phantom billing is submitting claims for care that never happened. Some schemes bill for services on dates the patient wasn’t present. Others fabricate patients entirely. Phantom billing produces the largest individual losses and attracts the most aggressive criminal prosecution.

Durable Medical Equipment

Durable medical equipment billed through HCPCS Level II codes is a recurring fraud target. Common schemes involve ordering prefabricated braces or orthotics for patients with no clinical need, often driven by advertising that offers “free” equipment, and billing for replacement items before the prior equipment’s useful lifetime has run.

The Federal Laws That Apply

Five federal statutes form the backbone of coding fraud enforcement. A single scheme almost always triggers liability under more than one.

The False Claims Act

The False Claims Act, codified at 31 U.S.C. § 3729, imposes civil liability on anyone who knowingly submits a false claim for payment to a federal program, or causes someone else to do so.⁵ Because nearly every coding fraud scheme results in a false claim to Medicare or Medicaid, this is the workhorse statute. Whistleblowers filed 1,297 qui tam suits under the Act in fiscal year 2025, the highest single-year total on record.¹

The Anti-Kickback Statute

The Anti-Kickback Statute, 42 U.S.C. § 1320a-7b(b), makes it a felony to offer, pay, solicit, or receive anything of value in exchange for referrals of services covered by a federal healthcare program.⁶ Claims tainted by a kickback are treated as false claims. Both sides of the transaction can be prosecuted.⁷

The Stark Law

The Stark Law, 42 U.S.C. § 1395nn, bars physicians from referring Medicare or Medicaid patients for designated health services to any entity in which the physician or an immediate family member holds a financial interest, unless a specific exception applies.⁸ Stark is strict liability. The government does not have to prove intent to defraud. If the referral violates the rule and no exception fits, the resulting claim is false.⁹

The Civil Monetary Penalties Law

The Civil Monetary Penalties Law gives the Office of Inspector General authority to impose financial penalties administratively, without a full court proceeding. Penalties can reach $20,000 per false claim plus an assessment of up to three times the amount claimed, and $100,000 per violation for kickback-related conduct.¹⁰

The 60-Day Overpayment Rule

Once a provider identifies an overpayment from Medicare or Medicaid, it must report and return the money within 60 days. Keeping it past that point converts the overpayment into an “obligation” under the False Claims Act, triggering treble damages and per-claim penalties on top of the original debt.¹¹ The clock starts when the overpayment is identified, not when the original claim went in.

What Offenders Actually Face

Civil, criminal, and administrative penalties stack. A single fraudulent billing pattern can produce liability under all three at once.

Civil Damages and Per-Claim Penalties

Under the False Claims Act, violators pay three times the government’s actual loss plus a per-claim penalty. After the most recent inflation adjustment, each false claim carries a penalty between $14,308 and $28,619.¹² The per-claim figure drives the math in coding fraud cases, because a provider may have submitted thousands of false claims across several years. Five hundred false claims at the minimum penalty produce more than $7 million before treble damages are even calculated.⁵

Prison Time

The federal Health Care Fraud statute, 18 U.S.C. § 1347, carries a maximum of 10 years in prison. If a patient suffers serious bodily injury as a result of the fraud, the maximum rises to 20 years. If a patient dies, the sentence can be life.¹³ Anti-Kickback Statute violations are separate felonies with their own 10-year maximum and fines up to $100,000 per offense.⁷ Prosecutors routinely layer in mail fraud, wire fraud, and conspiracy counts, producing decades of cumulative exposure.

Exclusion From Medicare and Medicaid

Exclusion is often the harshest consequence because it effectively ends a career. OIG must exclude any provider convicted of a program-related crime, patient abuse, a felony involving healthcare fraud, or a felony involving controlled substances. The minimum period for these mandatory exclusions is five years.¹⁴ While excluded, no federal program will pay for anything the provider furnishes, orders, or prescribes.¹⁵

OIG also has permissive exclusion authority covering misdemeanor fraud convictions, obstruction of audits, loss of a professional license, and billing for excessive unnecessary services.¹⁶ Reinstatement is not automatic. It requires a formal application and written OIG approval after the exclusion period ends.¹⁷

Corporate Integrity Agreements

Organizations that settle fraud allegations often avoid exclusion by signing a Corporate Integrity Agreement with OIG. A CIA runs five years and imposes detailed obligations: a dedicated compliance officer, an independent review organization auditing billing, restrictions on employing excluded individuals, and annual compliance reports to OIG. Breach of a CIA allows OIG to impose penalties or revive the exclusion it initially held back.¹⁸

How Cases Get Started

Most investigations begin with data, not a tip. Medicare contractors called Unified Program Integrity Contractors continuously analyze billing patterns for statistical anomalies. A practice that bills high-complexity visits at twice the rate of comparable providers in its specialty will draw a review. The contractor pulls clinical records for a sample of claims, compares them against the codes submitted, and if the error rate is high enough, extrapolates the findings across the provider’s full claim history. The resulting overpayment demand can dwarf the dollar value of the individual claims reviewed. The FBI serves as the primary criminal investigative agency and coordinates with OIG, state agencies, and private insurers.¹⁹

Whistleblowers drive the rest. Of the $6.8 billion the DOJ recovered under the False Claims Act in fiscal year 2025, more than $5.3 billion came from cases initiated by whistleblowers.¹ A billing clerk who notices phantom charges or a nurse who sees codes that don’t match the care delivered can trigger a multimillion-dollar recovery.

Reporting Fraud and Whistleblower Rewards

The False Claims Act’s qui tam provisions allow a private individual to sue on behalf of the United States against a provider defrauding a federal healthcare program. The suit is filed under seal while the DOJ investigates and decides whether to intervene.²⁰

If the government intervenes, the whistleblower receives between 15% and 25% of the recovery. If the government declines and the whistleblower proceeds alone, the share rises to 25% to 30%, plus reasonable attorneys’ fees and costs.²⁰ The Act also prohibits retaliation. Employees cannot be fired, demoted, suspended, threatened, or harassed because they tried to stop a false claim.

Anyone considering a qui tam case should talk to a whistleblower attorney before disclosing anything publicly, because premature discussion of a sealed complaint can jeopardize both the case and the whistleblower’s share. Tips can also be submitted without filing suit, through the OIG fraud hotline, OIG’s online reporting portal, or the FBI’s Internet Crime Complaint Center.

1
Department of Justice. False Claims Act Settlements and Judgments Exceed $6.8B in Fiscal Year 2025
2
Centers for Medicare & Medicaid Services (CMS). Medicare Fraud and Abuse: Prevent, Detect, Report
3
Centers for Medicare & Medicaid Services. Overview of Coding and Classification Systems
4
Centers for Medicare & Medicaid Services (CMS). NCCI for Medicare
5
Office of the Law Revision Counsel. 31 USC 3729 – False Claims
6
U.S. Department of Health and Human Services Office of Inspector General. General Questions Regarding Certain Fraud and Abuse Authorities
7
Office of the Law Revision Counsel. 42 USC 1320a-7b – Criminal Penalties for Acts Involving Federal Health Care Programs
8
Office of the Law Revision Counsel. 42 USC 1395nn – Limitation on Certain Physician Referrals
9
Centers for Medicare & Medicaid Services. Physician Self-Referral
10
eCFR. Part 1003 – Civil Money Penalties, Assessments and Exclusions
11
Office of the Law Revision Counsel. 42 USC 1320a-7k – Medicare and Medicaid Program Integrity Provisions
12
eCFR. 28 CFR Part 85 – Civil Monetary Penalties Inflation Adjustment
13
Office of the Law Revision Counsel. 18 USC 1347 – Health Care Fraud
14
Office of the Law Revision Counsel. 42 USC 1320a-7 – Exclusion of Certain Individuals and Entities From Participation in Medicare and State Health Care Programs
15
U.S. Department of Health and Human Services Office of Inspector General. Exclusions
16
eCFR. Subpart C – Permissive Exclusions
17
U.S. Department of Health and Human Services Office of Inspector General. Exclusions FAQs
18
U.S. Department of Health and Human Services Office of Inspector General. Corporate Integrity Agreements
19
FBI. Health Care Fraud
20
Office of the Law Revision Counsel. 31 USC 3730 – Civil Actions for False Claims