RCM Compliance and Audit Readiness: Avoiding False Claims Act and OIG Risk (2026)

The 2026 Compliance Landscape: Why RCM Audits Are Accelerating

Healthcare billing enforcement in 2026 is more aggressive, more technologically sophisticated, and more financially consequential than at any previous point. Several converging forces are driving this acceleration, and every RCM leader needs to understand the environment they are operating in.

First, government data analytics capabilities have fundamentally changed the audit calculus. The CMS Fraud Prevention System now analyzes 100% of Medicare fee-for-service claims in near real time, applying predictive models that flag statistical outliers before claims are even paid. This is not sampling. This is comprehensive surveillance. The system identified or prevented an estimated $2.1 billion in improper payments in its most recent reported year, and CMS continues to refine its algorithms with machine learning models trained on historical fraud patterns.

Second, qui tam whistleblower lawsuits continue to be the single largest source of False Claims Act recoveries. In FY2025, whistleblower-initiated lawsuits accounted for approximately 70% of all FCA healthcare recoveries. The financial incentives for whistleblowers are substantial: relators typically receive 15% to 30% of the government's recovery, which means a billing manager or coder who reports systemic upcoding at a large practice can receive a multi-million-dollar award. This creates an enforcement mechanism inside every healthcare organization.

Third, the OIG Work Plan for FY2026 has expanded its focus areas. Current priority targets include telehealth billing patterns that emerged during and after COVID-19, evaluation and management (E/M) code distribution shifts following the 2021 E/M guideline changes, modifier 25 usage on the same date as procedures, behavioral health billing under expanded parity enforcement, and Medicare Advantage risk adjustment data validation. Organizations billing in any of these areas face elevated audit risk regardless of whether their billing is accurate.

Enforcement Activity by the Numbers

How Payers and the OIG Select Audit Targets (The View from Inside)

From my time at Elevance Health working on payer strategy, and from advising health systems at Huron Consulting on how to respond to audit findings, I have seen the target selection process from both sides. Understanding how you end up on an audit list is the first step in staying off one.

The audit target selection process is not random. It is data-driven, and the data sources that feed it are more comprehensive than most providers realize. Here is how it works at each level of the enforcement ecosystem.

OIG and CMS Contractor Target Selection

The OIG uses a combination of claims data mining, peer comparison analysis, and referral-based triggers to select audit targets. The Fraud Prevention System ingests every Medicare FFS claim and applies over 100 analytic models that compare provider billing patterns against specialty-specific and geography-specific norms. Providers who bill significantly above the 90th percentile in any measured dimension receive a flag. Multiple flags across different dimensions compound the risk score.

Specific data patterns that trigger OIG attention include:

• E/M code distribution skew. If 70% of a provider's E/M visits are billed at level 4 or 5 when the specialty average is 45%, that provider will be flagged. The OIG publishes provider-level E/M distribution data publicly, and outlier providers can be identified by anyone, including qui tam attorneys looking for targets.
• Modifier 25 utilization rate. Providers who append modifier 25 (significant, separately identifiable E/M service) to more than 50% of claims on dates with a procedure are flagged. The national average for modifier 25 usage varies by specialty, but rates above the 90th percentile are a consistent audit trigger.
• Telehealth billing volume and patterns. Post-pandemic telehealth flexibilities are under intense scrutiny. Providers billing high volumes of complex telehealth visits, particularly in behavioral health, pain management, and primary care, are being compared against pre-pandemic baselines and peer norms.
• Billing for services not rendered. This is identified through beneficiary complaint analysis, where CMS contacts patients listed on claims to verify they received the billed services, and through impossible day analysis, where billing exceeds the number of hours in a day or reflects services at geographically impossible locations.
• Referral pattern anomalies. Unusual referral concentration, where a disproportionate share of referrals flow between a small number of providers, triggers Stark Law and Anti-Kickback Statute reviews in addition to FCA analysis.

Payer-Side Target Selection

Commercial payers use their own analytics platforms, which in many cases are more sophisticated than CMS's tools because they benefit from proprietary datasets that span multiple lines of business. From the payer side, the target selection criteria include:

• Cost outlier analysis. Payers compare per-member-per-month costs across providers within the same specialty and market. Providers whose cost per episode or cost per patient significantly exceeds the mean are flagged for utilization review.
• Denial overturn rate. Paradoxically, a high denial overturn rate on appeal can trigger additional scrutiny. If a provider consistently overturns clinical denials, the payer's medical policy team may conclude that the provider is gaming the appeals process and initiate a more intensive audit.
• Code pair analysis. Payers analyze code pair frequencies to identify unbundling. If a provider consistently bills two separate codes for services that should be reported as a single bundled code, the pattern is flagged automatically by claims editing systems like Cotiviti or Optum.
• New provider spike. Newly credentialed providers who immediately bill at the highest complexity levels or at volumes that exceed peers trigger new-provider monitoring protocols at most major payers.

False Claims Act Risk: What Every RCM Leader Must Know

The False Claims Act (31 U.S.C. 3729-3733) is the federal government's primary civil enforcement tool for healthcare billing fraud. Understanding its mechanics is not optional for anyone managing a revenue cycle because the liability exposure is severe, the standard of proof is lower than most people assume, and the consequences extend far beyond financial penalties.

The Knowledge Standard: Reckless Disregard

The FCA does not require proof of specific intent to defraud. It defines "knowing" to include acting with actual knowledge, deliberate ignorance, or reckless disregard of whether a claim is false. This means:

• An organization that submits upcoded claims because it never bothered to audit its coding accuracy has acted with reckless disregard.
• A billing manager who notices a pattern of questionable charges but fails to investigate has acted with deliberate ignorance.
• A practice that continues billing a code after receiving an audit finding that the code is not supported by documentation has actual knowledge.

The practical implication is that not having a compliance program is itself a risk factor. If the government can show that a reasonable compliance program would have detected the billing error, the absence of that program supports a finding of reckless disregard.

Penalty Structure

Common FCA Billing Scenarios

The following are the billing patterns most frequently targeted in FCA enforcement actions. None of them require intentional fraud; all can arise from sloppy billing practices, inadequate oversight, or coding errors that nobody caught.

• Upcoding. Systematically billing a higher-level E/M code than documentation supports. The most common pattern is billing 99214 or 99215 when documentation only supports 99213. Even a one-level upcoding error, when applied across thousands of claims, generates enormous FCA exposure.
• Unbundling. Billing separately for components of a procedure that should be reported as a single code. Common examples include billing separately for components of a surgical procedure, unbundling lab panels into individual tests, and billing an E/M visit with modifier 25 when no separate, identifiable service was performed.
• Services not rendered or not medically necessary. Billing for services that were not provided, or that were provided but lacked medical necessity. This includes billing for diagnostic tests ordered without clinical indication, therapy sessions that did not occur at the billed duration, and follow-up visits with no clinical content beyond prescription refills.
• Misrepresentation of provider credentials. Billing under a physician's NPI for services performed by a non-physician practitioner at a higher rate. This "incident-to" abuse is a perennial FCA target.
• Retention of known overpayments. Under the 60-day rule (42 U.S.C. 1320a-7k(d)), providers who identify an overpayment and fail to report and return it within 60 days of identification face FCA liability for the retained overpayment. This turns every discovered billing error into a ticking compliance clock.

Building a Coding Compliance Program That Actually Works

The OIG has published compliance program guidance for virtually every healthcare provider type, and all of it centers on seven core elements. But having seven elements on paper is not the same as having a compliance program that actually works. I have reviewed compliance programs at organizations ranging from 10-provider practices to large health systems, and the difference between programs that prevent FCA exposure and programs that exist only in a policy binder comes down to execution, resources, and organizational commitment.

The Seven OIG Elements, Applied to RCM

Compliance Program Budget Benchmarks

An effective compliance program requires real investment. Organizations that treat compliance as an unfunded mandate get compliance programs that do not work. The following benchmarks reflect what functional compliance programs cost across different organization sizes:

• Small practices (5-20 providers): $75,000 to $200,000 annually, covering a part-time compliance officer, external audit services, compliance training platform, and hotline subscription.
• Mid-size groups (20-100 providers): $200,000 to $500,000 annually, covering a dedicated compliance officer, internal audit staff or contracted audit services, compliance technology platform, training programs, and legal counsel retainer.
• Large systems (100+ providers): $500,000 to $2 million or more annually, covering a compliance department with multiple FTEs, internal audit team, enterprise compliance technology, ongoing external audit engagements, and board-level compliance reporting infrastructure.

Compare these costs to the average FCA settlement of $5.4 million and the potential for per-claim penalties in the tens of millions, and the investment case is clear.

RAC, MAC, and ZPIC Audits: Preparation and Response Playbooks

Medicare program integrity audits come from multiple contractors, each with different authority, methodology, and response requirements. Knowing which contractor is contacting you and what authority they have is the first step in mounting an effective response.

Understanding the Contractors

Recovery Audit Contractors (RACs) are private companies contracted by CMS to identify improper Medicare payments. They are compensated on a contingency basis, earning a percentage (typically 9% to 12.5%) of overpayments they identify and that survive the appeals process. This contingency model creates a financial incentive for RACs to find overpayments, which is why RAC audits tend to focus on high-volume, high-dollar services where the return on their audit investment is greatest. RACs conduct both automated reviews (where claims are denied based on data analysis without medical record review) and complex reviews (where medical records are requested and reviewed by clinical staff).

Medicare Administrative Contractors (MACs) are the entities that process and pay Medicare claims in each jurisdiction. MACs conduct both pre-payment reviews (holding claims for documentation before payment) and post-payment reviews (requesting documentation after claims have been paid). MAC audits are often triggered by data analysis but can also result from beneficiary complaints or referrals from other contractors.

Unified Program Integrity Contractors (UPICs), which replaced Zone Program Integrity Contractors (ZPICs), have the broadest authority. UPICs investigate suspected fraud, waste, and abuse and have the power to impose payment suspensions, refer cases to the OIG or DOJ for civil or criminal action, and recommend provider exclusion. A UPIC investigation is the most serious audit scenario a provider can face because it signals that the government suspects intentional or systemic misconduct, not just isolated billing errors.

Audit Response Timelines and Requirements

Audit Response Best Practices

• Assemble your response team immediately. The moment you receive an audit notification, assemble your compliance officer, coding lead, medical records manager, billing manager, and legal counsel. For UPIC investigations, engage healthcare regulatory counsel before responding to any request.
• Never miss a deadline. Record request and appeal deadlines are jurisdictional and non-negotiable. Missing a response deadline for a RAC record request results in an automatic overpayment determination. Missing an appeal deadline waives your right to appeal. Calendar every deadline and build in a buffer.
• Submit complete records. When responding to a medical record request, submit every page of the medical record that supports the billed service, including the face sheet, progress notes, orders, test results, medication administration records, and any addenda. Incomplete submissions are the most common reason for audit failures that would otherwise have been sustained.
• Track and analyze audit results. Maintain a database of every audit finding, the outcome of every appeal, and the root cause of every adverse determination. Audit findings are a free compliance audit. Use them to identify and fix systemic issues rather than treating each finding as an isolated event.
• Know when to settle and when to appeal. Not every adverse audit finding is worth appealing. If the documentation genuinely does not support the billed code, accept the finding, refund the overpayment, and fix the underlying issue. Appeal only when you have a defensible position. Frivolous appeals waste resources and can damage credibility with the auditing contractor.

Payer-Initiated Audits: Prepayment and Post-Payment Review

Government audits receive the most attention, but commercial payer audits are more frequent, more operationally disruptive, and in many cases more financially impactful on a day-to-day basis than Medicare audits. Every major commercial payer operates a Special Investigations Unit (SIU) and a claims audit program that reviews provider billing patterns continuously.

Prepayment Review

Prepayment review means the payer holds specific claims and requires documentation before releasing payment. This is the most operationally disruptive form of payer audit because it directly impacts cash flow. Claims selected for prepayment review can take 30 to 90 additional days to pay, and during that period the organization is providing services without compensation for the affected claim types.

Prepayment review is typically triggered by:

• Denial rates on specific service types that exceed payer thresholds
• Billing pattern shifts that deviate from historical norms (such as a sudden increase in high-complexity visits)
• Prior audit findings that identified a pattern of overbilling
• Tips or complaints from patients or other providers

The key to surviving prepayment review is documentation turnaround time. Organizations that can produce and submit complete medical records within 5 to 7 business days of a prepayment review request minimize the cash flow impact. Organizations that take 30 days to compile records face compounding cash flow disruption.

Post-Payment Review and Recoupment

Post-payment review occurs after claims have been paid. The payer requests medical records for a sample of paid claims, reviews the documentation, and determines whether the billed services were supported. If the payer finds that a percentage of the sample was overbilled, it extrapolates the error rate across the entire universe of claims in the audit period and issues a recoupment demand for the extrapolated amount.

Extrapolation is where post-payment review becomes financially devastating. A payer that reviews 50 claims and finds a 20% error rate may extrapolate that rate across 5,000 claims in the audit period, resulting in a recoupment demand that far exceeds the overpayments identified in the actual sample. Challenging the statistical methodology of the extrapolation is a critical defense strategy that requires biostatistical expertise.

Payer Audit Response Checklist

• Review your payer contract for the audit provisions, including record request timelines, appeal rights, and recoupment procedures. Many payer contracts contain specific audit terms that differ from the payer's standard audit policy.
• Confirm the payer's legal authority to audit. Self-funded ERISA plans may have different audit rights than fully insured plans, and out-of-network providers may have different obligations than in-network providers.
• Engage a qualified coding expert to review every audited claim before submitting records. If the coding is defensible, submit the records with a cover letter explaining the coding rationale. If the coding is not defensible, consider proactive disclosure and negotiation.
• If the payer uses statistical extrapolation, retain a biostatistician to review the sampling methodology and extrapolation calculations. Common challenges include inadequate sample size, non-random sampling, incorrect stratification, and improper confidence interval calculations.
• Document every interaction with the payer's audit team. Maintain a log of all records submitted, all correspondence received, and all deadlines. Payer audit departments are high-volume operations, and records get lost. Your documentation is your protection.

Self-Audit Programs: Finding Problems Before the Government Does

A self-audit program is the most important component of your compliance infrastructure. It is the mechanism that transforms compliance from a reactive posture (responding to external audits) to a proactive one (identifying and correcting issues before they generate enforcement risk). Every organization should be auditing its own billing continuously.

Types of Self-Audits

An effective self-audit program includes three types of audits running concurrently:

• Prospective coding audits review charges before claim submission. A certified coder reviews a sample of coded encounters, compares the assigned codes to the documentation, and corrects errors before the claim goes out the door. This is the highest-value audit type because it prevents errors rather than detecting them after the fact. Target: 5 to 10 encounters per provider per month.
• Retrospective coding audits review claims after submission and payment. A sample of paid claims is pulled, the medical records are re-reviewed, and the coding is compared to the documentation. This identifies patterns of over-coding or under-coding that prospective audits may miss because retrospective audits can be conducted on larger samples. Target: minimum 30 claims per provider per year, with a statistically valid random sample plus targeted samples of high-risk areas.
• Focused audits target specific risk areas identified through data analysis, OIG Work Plan priorities, external audit findings, or internal concerns. Examples include a focused audit of modifier 25 usage after data analysis shows above-peer utilization, a focused audit of telehealth billing after the OIG announces a telehealth enforcement priority, or a focused audit of a specific provider whose E/M distribution has shifted upward. Focused audits should be initiated whenever a risk area is identified, not on a fixed schedule.

Self-Audit Methodology

A credible self-audit follows a structured methodology that would withstand scrutiny if reviewed by the OIG or DOJ as evidence of the organization's compliance efforts:

• Define the audit scope and objective in writing before beginning the audit. Identify what services, providers, time periods, and codes will be reviewed.
• Select the sample using a statistically valid random sampling methodology. For focused audits targeting a specific concern, a convenience sample of the relevant claims is acceptable, but document the selection rationale.
• Conduct the review using credentialed auditors (CPC, CCS, or equivalent). Each claim should be re-coded independently based solely on the documentation, then compared to the submitted code. Document the rationale for any disagreement.
• Calculate error rates by error type: over-coding, under-coding, unbundling, incorrect modifier usage, missing documentation, and services not supported. Distinguish between errors that result in overpayments (compliance risk) and errors that result in underpayments (revenue opportunity).
• Report findings to the compliance officer and compliance committee. Include specific error examples, error rates by category, comparison to prior audit periods, and recommended corrective actions.
• Implement corrective actions with specific owners, deadlines, and measurable outcomes. Track corrective action completion and measure whether error rates decrease in subsequent audits.
• Address overpayments within the 60-day refund window. If the audit identifies overpayments, calculate the total overpayment amount, report it to the affected payers, and process refunds within 60 days of identification.

Documentation Standards That Survive Audit Scrutiny

In an audit, the medical record is the only evidence that matters. The service billed must be supported by the documentation in the record at the time the service was provided. Auditors will not accept verbal explanations, after-the-fact attestations, or arguments about what the provider "meant" to document. If it is not in the record, it did not happen for billing purposes.

Documentation Requirements by Service Type

While documentation requirements vary by payer and service type, the following principles apply universally:

• Evaluation and management visits must document medical decision-making or total time consistent with the billed level. Under the 2021 E/M guidelines, the documentation must support either the level of medical decision-making (number and complexity of problems addressed, amount and complexity of data reviewed, and risk of complications and/or morbidity or mortality) or the total time spent on the encounter including pre- and post-visit activities. Time-based billing requires explicit documentation of the total time and a description of the activities performed.
• Procedures must document the indication, the procedure performed (including technique, findings, and complications), and a post-procedure plan. The operative or procedure note must be detailed enough that another qualified provider could understand exactly what was done and why.
• Modifier 25 requires documentation of a significant, separately identifiable E/M service beyond the typical pre-service and post-service work included in the procedure. The documentation must show a separate chief complaint or clinical issue, a separate history and examination related to that issue, and a separate medical decision-making process. Simply adding a brief HPI to a procedure note does not satisfy this standard.
• Telehealth visits must document the same clinical elements required for in-person visits at the same level. Additionally, documentation should include the telehealth modality used (audio-video or audio-only where permitted), the patient's location, and any limitations encountered due to the telehealth format.
• Behavioral health services must document the specific therapeutic interventions used, the time spent in direct service delivery, the patient's response to treatment, and progress toward treatment goals. For psychotherapy, documentation must support the billed time code (30 minutes, 45 minutes, or 60 minutes) with start and stop times or a clear indication of total direct service time.

Common Documentation Failures

The following documentation problems are identified in virtually every compliance audit I have reviewed. They are the most common reasons claims fail audit scrutiny:

• Clone documentation. EHR templates that copy forward prior visit documentation without meaningful updates create records that appear identical from visit to visit. Auditors flag clone documentation as evidence that the provider is not performing and documenting a unique encounter, and in extreme cases it supports allegations of services not rendered.
• Missing time documentation. For time-based services including many E/M visits, psychotherapy, and critical care, the total time must be documented explicitly. "Spent significant time counseling" does not meet the standard. "Total time 38 minutes, including 20 minutes of counseling regarding treatment options" does.
• Unsigned or undated notes. Medical record entries must be signed (or electronically authenticated) and dated. Unsigned notes may be treated as if they do not exist for audit purposes.
• Late entries and addenda. While late entries and addenda are acceptable when properly documented, entries made after an audit notification or after the provider has been informed of a billing dispute are viewed with extreme skepticism by auditors and may be excluded from consideration.
• Insufficient medical necessity. Documentation must establish why the service was medically necessary for this patient at this time. An order for an MRI without documented clinical findings supporting the need for imaging will fail medical necessity review regardless of how well the MRI itself is documented.

Compliance Technology and Monitoring Tools

Manual compliance monitoring cannot keep pace with the volume and complexity of modern healthcare billing. Technology tools have evolved significantly in the past three years, and organizations that deploy them effectively can detect compliance issues in near real time rather than discovering them months later in a retrospective audit.

Claims Analytics and Monitoring Platforms

Modern compliance analytics platforms ingest claims data and apply rule-based and statistical models to identify billing anomalies. Key capabilities to evaluate include:

• Code distribution monitoring. Real-time dashboards that show each provider's E/M level distribution, modifier usage rates, and procedure frequency compared to specialty benchmarks. Alerts trigger when a provider's distribution deviates beyond a configurable threshold from peer norms.
• Claim edit analysis. Platforms that apply CCI (Correct Coding Initiative) edits, LCD/NCD (Local/National Coverage Determination) requirements, and payer-specific rules to claims before submission. This is the technology equivalent of a prospective coding audit, catching unbundling errors, medical necessity gaps, and modifier misuse before the claim goes out.
• Trend analysis. Tools that track billing patterns over time and flag significant shifts. A provider whose average E/M level increases by 0.3 points in a quarter, or whose modifier 25 usage doubles, generates an alert that prompts a focused review.
• Peer benchmarking. Access to external benchmark data that allows the organization to compare its billing patterns to specialty and geography-specific norms. This is the same type of comparative analysis that the OIG and payers use to select audit targets, and using it proactively allows the organization to see what auditors see.

AI-Assisted Compliance Tools

Artificial intelligence is increasingly embedded in compliance technology, offering capabilities that were not feasible with traditional rule-based systems:

• Natural language processing for documentation review. AI tools that read clinical notes and independently assess the supported E/M level, identify missing documentation elements, and flag notes where the documentation does not support the billed code. These tools can review 100% of encounters rather than the 5% to 10% sample that human auditors can cover.
• Predictive audit risk scoring. Models that analyze an organization's claims data against the same patterns that trigger OIG, RAC, and payer audits, generating a risk score that identifies which providers and service types are most likely to be audited. This allows compliance resources to be directed at the highest-risk areas.
• Automated anomaly detection. Machine learning models that establish baseline billing patterns and automatically detect deviations that may indicate coding drift, new employee errors, or emerging compliance issues. These models improve over time as they learn the organization's normal patterns.

Compliance Technology Evaluation Framework

The technology is only as effective as the workflow built around it. An analytics platform that generates alerts nobody reads, or a claims editing engine whose warnings are overridden without review, provides no compliance protection. Technology must be embedded in daily workflows with clear escalation paths, defined response protocols, and accountability for acting on alerts.

Voluntary Self-Disclosure: When and How to Report to the OIG

When your self-audit program identifies a significant compliance issue, particularly one involving potential overpayments to federal healthcare programs, you face a critical decision: whether to voluntarily self-disclose to the OIG. This is one of the most consequential decisions a healthcare organization can make, and it should be made with experienced legal counsel.

The OIG's Self-Disclosure Protocol provides a structured process for providers to report potential fraud affecting federal healthcare programs. The benefits of voluntary self-disclosure are substantial:

• Reduced penalties. The OIG typically settles self-disclosed matters at 1.5x the overpayment amount, compared to treble damages (3x) under the FCA. For a $1 million overpayment, the difference between a self-disclosed settlement ($1.5 million) and an FCA resolution ($3 million plus per-claim penalties) is enormous.
• Avoidance of per-claim penalties. Self-disclosed matters typically do not include the $13,946 to $27,894 per-claim FCA penalties that apply in government-initiated investigations.
• Reduced exclusion risk. Voluntary self-disclosure demonstrates good faith and significantly reduces the risk of permissive exclusion from federal healthcare programs.
• Corporate Integrity Agreement avoidance. Self-disclosed matters are less likely to result in a five-year CIA, which imposes substantial ongoing compliance costs and operational constraints.
• Demonstrates compliance program effectiveness. The fact that the organization's own compliance program identified the issue supports a narrative of good faith and effective compliance infrastructure.

The decision to self-disclose should consider the magnitude of the overpayment, the duration over which the error occurred, whether the error was systemic or isolated, the risk that the issue will be discovered independently (through a whistleblower or audit), and the organization's history of compliance issues. Generally, systemic overpayments affecting federal healthcare programs exceeding $100,000 warrant serious consideration of self-disclosure.

Frequently Asked Questions

What triggers a False Claims Act investigation in healthcare billing?

False Claims Act investigations are most commonly triggered by qui tam whistleblower lawsuits filed by current or former employees, statistical outlier analysis by the OIG or CMS contractors showing billing patterns that deviate significantly from peer norms, referrals from Recovery Audit Contractors (RACs) or Zone Program Integrity Contractors (ZPICs) after identifying aberrant claims, complaints from patients or competing providers, and data mining by the OIG using the Fraud Prevention System which analyzes all Medicare claims in near real time. The government does not need to prove intent to defraud; it only needs to show that the provider acted with reckless disregard or deliberate ignorance of the truth or falsity of claims submitted.

How much are False Claims Act penalties in 2026?

As of 2026, False Claims Act penalties range from $13,946 to $27,894 per false claim submitted, plus treble (triple) damages on the amount of the false claim. These per-claim penalties are adjusted annually for inflation. For a provider submitting hundreds or thousands of claims with the same billing error, the per-claim penalty structure means even a modest coding error applied systematically can generate liability in the tens of millions of dollars. In FY2025, the Department of Justice recovered over $2.9 billion in healthcare fraud settlements and judgments under the False Claims Act.

What is the difference between RAC, MAC, and ZPIC audits?

Recovery Audit Contractors (RACs) identify improper Medicare payments through post-payment review and are compensated on a contingency basis, earning a percentage of overpayments they identify. Medicare Administrative Contractors (MACs) process and pay Medicare claims and conduct pre-payment and post-payment reviews as part of their administrative role. Zone Program Integrity Contractors (ZPICs), now being replaced by Unified Program Integrity Contractors (UPICs), focus specifically on fraud, waste, and abuse investigations and have broader investigative authority including the ability to impose immediate payment suspensions and refer cases to the OIG or DOJ for criminal prosecution. Each audit type requires a different response strategy and timeline.

How often should healthcare organizations conduct internal compliance audits?

Healthcare organizations should conduct prospective coding audits continuously as part of their standard workflow, with a minimum sample of 5 to 10 claims per provider per quarter. Comprehensive retrospective audits should be conducted at least annually, covering a statistically valid random sample plus targeted reviews of high-risk areas such as evaluation and management upcoding, modifier usage, and services with the highest denial rates. The OIG recommends that organizations also conduct focused audits whenever they identify a potential compliance issue, change a billing practice, add a new service line, or receive an external audit finding. Organizations with prior compliance issues or Corporate Integrity Agreements may be required to audit more frequently, often monthly or quarterly with external auditor oversight.

What are the seven elements of an effective compliance program according to the OIG?

The OIG outlines seven elements for an effective compliance program: (1) written policies, procedures, and standards of conduct that address specific risk areas; (2) designation of a compliance officer and compliance committee with sufficient authority and resources; (3) effective training and education for all affected employees, including annual compliance training and role-specific coding and billing training; (4) effective lines of communication including an anonymous reporting mechanism such as a compliance hotline; (5) well-publicized disciplinary standards for non-compliance that are enforced consistently; (6) effective internal monitoring and auditing systems to detect compliance issues proactively; and (7) prompt response to detected offenses including investigation, corrective action, and voluntary self-disclosure to the government when appropriate. These elements are not optional suggestions; they form the baseline that the OIG and DOJ evaluate when determining whether an organization had an effective compliance program at the time of an alleged violation.

Editorial Standards

Last reviewed: February 19, 2026

Methodology

• Compliance program requirements and enforcement data sourced from OIG published guidance, Work Plans, and annual reports
• False Claims Act penalty amounts and recovery statistics sourced from DOJ Civil Division annual fraud statistics reports
• Audit response procedures based on CMS Medicare Program Integrity Manual and contractor-specific guidance
• Payer audit practices informed by direct experience with commercial payer SIU operations and claims audit programs
• Self-audit methodology aligned with OIG Compliance Program Guidance for Individual and Small Group Physician Practices and subsequent updates

Primary Sources

• OIG Compliance Program Guidance
• DOJ Civil Division Fraud Statistics
• CMS Medicare Program Integrity Manual
• OIG Self-Disclosure Protocol
• OIG Work Plan