Medical billing is governed by multiple federal and state laws, but five federal laws are particularly important for healthcare providers: the False Claims Act, Anti-Kickback Statute, Stark Law, HIPAA, and No Surprises Act. Together, they address inaccurate claims, improper referral payments, physician self-referrals, patient health information, and surprise billing. 

Good healthcare billing services protect your revenue and your license at the same time. This guide covers the five federal laws every US provider should understand, along with the lesser known details that trip up even careful practices.

Top 5 Medical Billing Laws

Five federal laws shape how US healthcare providers bill: the False Claims Act, the Anti-Kickback Statute, the Stark Law, HIPAA, and the No Surprises Act. The first three police the honesty of claims and referral relationships. HIPAA governs patient data, and the No Surprises Act governs what patients can be charged.

Law	What it governs	Who it applies to	Key risk
False Claims Act	Accuracy and support for every claim	Any provider billing federal programs	Triple damages plus per-claim penalties
Anti-Kickback Statute	Payments or perks tied to referrals	Anyone involved in federal program business	Prison, fines, exclusion
Stark Law	Physician referrals for designated health services	Physicians and entities billing Medicare	Denied payment and refunds, even without intent
HIPAA	Privacy, security, and standard transactions	Covered entities and business associates	Tiered fines and breach duties
No Surprises Act	Out-of-network billing and self-pay estimates	Providers, facilities, and plans	Up to $10,000 per violation

Law 1: The False Claims Act (FCA)

What the False Claims Act Is and What Counts as a False Claim

The False Claims Act is a federal law that makes it illegal to knowingly submit false or inflated claims to a government program such as Medicare, Medicaid, or TRICARE. It is the main civil tool the Department of Justice uses against healthcare billing fraud.

Upcoding, unbundling, billing for services not provided, and billing for care that was not medically necessary are the well known examples. Less obvious ones include billing a service that broke a condition of payment, such as a supervision rule or a required piece of documentation.

Intent works differently than most providers think. The FCA covers actual knowledge, deliberate ignorance, and reckless disregard. In 2023 the US Supreme Court ruled in the SuperValu case that what a defendant actually believed at the time is what counts, not what a reasonable person might have believed. Internal emails or notes showing you doubted a billing practice can be used against you.

FCA Penalties and the Whistleblower Risk Inside Your Practice

The government can seek three times its loss plus a penalty for every false claim. Penalties are adjusted for inflation each year, and recent figures run from about $14,000 to about $28,000 per claim. Each line item can count separately, so one visit with several codes can produce several penalties.

Under the FCA, a private person called a relator can sue on the government’s behalf and typically receives 15 to 30 percent of any recovery. Most relators are insiders, such as billers, coders, or former employees. The law also protects employees from retaliation, so a reporting channel that staff trust is one of the simplest ways to lower this risk.

How the 60-Day Overpayment Rule Works for Providers

Providers must report and return Medicare and Medicaid overpayments within 60 days of identifying them. Since January 1, 2025, an overpayment counts as identified when you knowingly receive or keep it, which includes deliberate ignorance and reckless disregard. The clock can start even before you have calculated the full amount.

There is some relief. If you begin a timely, good faith investigation into related overpayments, the 60-day clock can pause for up to 180 days. The lookback period is six years, so one error you find should lead you to ask where else it happened.

What a Real Texas Case Teaches and How to Lower Your FCA Risk

In a Texas case, a jury found that a medical group submitted 21,844 false claims and collected about $2.75 million in overpayments. Per-claim penalties pushed the award to roughly $449 million, and a federal court later ruled the penalty unconstitutionally excessive under the Eighth Amendment. The lesson is that one billing pattern repeated across thousands of claims creates exposure far beyond the money collected.

Start with a routine medical coding and billing audits that samples claims by provider, code, and payer. Pay extra attention to evaluation and management levels, modifier 25, incident-to billing, and telehealth.

Repeated denials deserve attention too, because ignoring the same warning sign again and again can look like reckless disregard. Whatever you uncover, document it, fix it, and refund when needed. Written proof that you looked and acted is among your strongest protections.  It will help you Reduce Claim Denials in Medical Billing.

Law 2: The Anti-Kickback Statute (AKS)

What the Anti-Kickback Statute Prohibits and Where Providers Slip Up

The AKS makes it a crime to knowingly and willfully offer, pay, ask for, or accept anything of value to induce or reward referrals for services paid by federal healthcare programs. Anything of value is a wide net. It can include cash, free staff, below market rent, meals, or discounted services.

Patient perks are the first place providers slip. The OIG treats routine waivers of copays and deductibles as potential kickbacks. It also considers gifts to patients nominal only up to $15 per item and $75 per year, and never in the form of cash or gift cards. A hardship waiver is acceptable when it is based on real financial need, decided case by case, and not advertised.

Marketing deals are the second. Paying a marketing company per patient referred can look like paying for referrals, even when it is described as advertising. Flat, fair market fees for real services are far safer.

Safe Harbors, Penalties, and How Kickbacks Become FCA Cases

A safe harbor is a set of rules that, if followed exactly, protects an arrangement from AKS liability. Common ones cover employment, personal service contracts, space and equipment rentals, and certain discounts. The catch is that you must meet every condition, not most of them. Agreements should be in writing, at fair market value, and not based on referral volume.

A conviction can mean up to ten years in prison and fines of up to $100,000 per violation, along with civil penalties and exclusion from federal programs. Since 2010, a claim that results from an AKS violation also counts as false under the FCA, which is why kickback cases so often bring whistleblowers and per-claim penalties with them.

Law 3: The Stark Law

What the Stark Law Prohibits and Which Services It Covers

The Stark Law, also called the physician self-referral law, bars a physician from referring Medicare patients for designated health services to an entity where the physician or an immediate family member has a financial relationship, unless an exception applies. The entity also cannot bill for those referrals.

Designated health services include clinical laboratory services, physical and occupational therapy, radiology and imaging, durable medical equipment, home health, outpatient prescription drugs, and inpatient and outpatient hospital services.

Stark vs. AKS: Key Differences

Aspect	Anti-Kickback Statute	Stark Law
Type of law	Criminal and civil	Civil
Intent	Must be knowing and willful	Not required (strict liability)
Scope	Any item or service paid by federal programs	Mainly Medicare, designated health services
Who it targets	Anyone offering or taking value for referrals	Physicians and entities billing for their referrals
Protection	Safe harbors, met exactly	Exceptions, met exactly

Common Stark Traps, Exceptions, and What to Do If You Find a Violation

Stark trouble usually hides in paperwork, not intent. Leases and compensation agreements that have expired, were never signed, or are not at fair market value are the top trap. Pay that changes with referrals and a family member’s ownership interest that nobody tracked are close behind. The arrangement must also be commercially reasonable, meaning it makes business sense even if no referrals ever happened.

An exception is a set of rules that makes a financial relationship acceptable. The in-office ancillary services exception, for example, lets a group practice provide certain services like labs or imaging in-house when strict conditions are met. Others cover office space rental, employment, and fair market value compensation, and every element must be met. CMS does allow 90 days to complete a missing writing or signature, as long as the terms of the arrangement are not changed during that window.

If you find a violation, CMS runs the Voluntary Self-Referral Disclosure Protocol, which can lead to a reduced settlement. Because Stark violations can also support FCA claims, speak with healthcare counsel before you file.

Law 4: HIPAA (Health Insurance Portability and Accountability Act)

How HIPAA Applies to Billing and the Minimum Necessary Rule

HIPAA (is more than a privacy law. It also sets standard electronic transactions and code sets, which is why claims travel in a set format and carry National Provider Identifiers. Billing teams handle protected health information (PHI) all day, in claims, statements, and phone calls about balances.

PHI can be used for payment, but only the minimum necessary should be shared. A statement that shows more diagnosis detail than needed, or that goes to an old address, can be a violation.

Two lesser known patient rights matter here. Patients can ask for statements to go to a different address or by a different method, and you must honor reasonable requests. And if a patient pays in full out of pocket and asks you not to share that service with their health plan, you generally must agree.

Security Rule Safeguards and Business Associate Agreements

The Security Rule requires safeguards for electronic PHI, including access controls, encryption where appropriate, audit logs, and a documented risk analysis. OCR has repeatedly named an incomplete risk analysis as the most common failing in its investigations. Billing software, clearinghouse connections, and patient payment portals all belong in that analysis.

Billing companies, healthcare revenue cycle management partners, clearinghouses, collection agencies, and software vendors that handle PHI are business associates, and you need a signed business associate agreement with each one. Collection agencies deserve a second look, since account details often go out before anyone checks the agreement.

Breach Notification and the HIPAA Changes to Watch

If unsecured PHI is breached, you must notify affected patients without unreasonable delay and within 60 days of discovery. Breaches affecting 500 or more people also require notice to HHS and, in many cases, the media. Smaller breaches are logged and reported to HHS after the year ends. Some states set shorter deadlines, so follow whichever rule is stricter.

A major Security Rule update was proposed in January 2025. HHS has since pushed final action to at least July 2027, and the current rule stays fully enforceable in the meantime. One change is already in effect: the updated Notice of Privacy Practices tied to substance use disorder records was due on February 16, 2026.

Law 5: The No Surprises Act (NSA)

What the No Surprises Act Covers and the Notice Many Practices Miss

The No Surprises Act, in effect since January 1, 2022, bans balance billing for emergency services, for certain non-emergency services by out-of-network providers at in-network facilities, and for air ambulance services. Patients pay only their in-network cost share, and the plan and provider settle the rest.

Providers and facilities must also make a one-page notice about balance billing protections public, post it on their website, and give it to patients no later than when payment is first requested. Many practices focus on estimates and forget this notice. CMS mostly investigates through patient complaints, and penalties can reach $10,000 per violation. A provider who did not knowingly break the rule can avoid the penalty by withdrawing the bill and refunding the patient within 30 days.

Good Faith Estimates for Self-Pay and Uninsured Patients

For uninsured and self-pay patients, you must offer a Good Faith Estimate. It is due within three business days if the service is scheduled at least ten business days ahead, within one business day if it is scheduled three to nine business days ahead, and within three business days of a request made before scheduling. It applies to all types of care, including behavioral health.

If the final bill is $400 or more above the estimate, the patient can start a payment dispute, generally within 120 days. Keep each estimate in the patient’s record for six years, and track due dates the way you track prior authorizations.

Out-of-Network Consent and Payment Disputes With Insurers

Out-of-network providers at in-network facilities can bill beyond in-network cost sharing only with proper written notice and consent. This option is not available for ancillary services such as anesthesia, pathology, or radiology. The consent must be on its own form, and care cannot depend on the patient signing it.

When a payer and an out-of-network provider disagree on payment, the process starts with 30 business days of open negotiation. If that fails, either side can start independent dispute resolution within four business days. The arbitrator weighs the qualifying payment amount, which reflects the plan’s median in-network rate, along with other factors.

Other Billing Rules Healthcare Providers Should Also Know

Medicare and Medicaid Billing Requirements

Medicare Part B claims generally must be filed within 12 months of the date of service. If your billing company receives Medicare payments for you, Medicare requires that its pay not be tied to the dollars billed or collected, and Medicaid has a similar rule. Percentage-based contracts are common, so have counsel check how yours is structured and where the money lands.

Contractors also run Targeted Probe and Educate reviews, which look at a small sample of claims and offer provider education before escalating.

State Laws, Price Transparency, and Coding Standards

States add their own layers. Many have state false claims acts, plus anti-kickback and self-referral laws that reach commercial insurance as well. Others set balance billing limits and prompt payment rules. When state and federal rules differ, follow the stricter one.

The federal price transparency rule applies to hospitals, not physician practices, but the Good Faith Estimate plays a similar role for self-pay patients. On the coding side, CPT, ICD-10-CM, and HCPCS Level II are the HIPAA-required code sets. ICD-10-CM updates take effect every October 1 and HCPCS codes update quarterly, so templates, superbills, and coding software need regular refreshes.

OIG Exclusion Screening 

Check every employee, contractor, and vendor against the OIG exclusion list at hire and every month after, and check your state Medicaid exclusion list too. Federal programs will not pay for services tied to an excluded person, and you can face penalties and repayment.

This screening works best alongside medical provider credentialing, so a person is verified for both licensure and eligibility before their first claim goes out.

Frequently Asked Questions

• Can a small practice be held liable for a billing company’s mistake?
  Yes. The FCA has no size exemption, and your name and NPI are on every claim. Hiring a vendor shifts the work, not the liability, so contracts, oversight, and spot checks of outside billers matter.

• How often should a practice audit its billing?
  At least once a year, with quarterly reviews of higher risk areas. Audit sooner after a new coder joins, a payer changes a rule, or denials suddenly rise.

• How long should billing records be kept?
  The FCA can reach back as far as ten years, so many compliance experts advise keeping billing records that long. HIPAA requires compliance documentation to be kept for six years, and some payers and states set their own rules.

• What should I do first if I receive an audit or records request?
  Note the deadline, send the request to your compliance contact, and gather exactly what was asked for. Never alter or backfill records, and involve healthcare counsel early if the request comes from a government contractor or investigator.

• Do these laws apply to telehealth billing?
  Yes. Telehealth claims are subject to the same FCA, AKS, and HIPAA rules, and telehealth platforms that handle PHI need business associate agreements too. Coverage and billing rules vary by payer and state and have changed often, so confirm current policy before you bill.

Conclusion

These five laws come down to a few habits. Bill only what was done and documented. Never pay or accept value for referrals. Keep financial relationships written, signed, and at fair market value. Protect patient data, and be upfront with patients about cost.

Start small. Run one audit this quarter, review every contract that touches referrals, and check that your website carries the No Surprises Act notice.

How Can PHCSS Help Your Practice Stay Compliant?

Knowing these laws is the easy part. Applying them to every claim, contract, and patient estimate is where most practices need steady support.

Proactive Healthcare Services works with healthcare providers to keep billing accurate, compliant, and profitable. Our team helps you review claims for coding and documentation gaps, strengthen your revenue cycle, and keep provider enrollment on track, so problems are caught before a payer or auditor finds them.

Want to know where your practice stands? Contact PHCS today and talk with our team about a compliance-minded look at your billing process.