The consequences of coding fraud and abuse range from six-figure civil fines per claim to decades in federal prison, and for most providers the career-ending blow is exclusion from Medicare and Medicaid. Which consequences actually land on you depends on whether the government treats the conduct as fraud or abuse, how much money was involved, and whether prosecutors can prove you acted knowingly.
Fraud or Abuse: Why the Label Changes the Stakes
The government separates coding fraud from coding abuse based on intent. Fraud means knowingly submitting false claims or making deliberate misrepresentations to get paid for something you weren’t entitled to, such as billing for services never provided. Abuse covers practices that cost federal programs money but stop short of intentional deception, such as upcoding a procedure to a higher-paying code without documentation to support it.
Both can produce criminal, civil, and administrative liability, but fraud carries the heavier hammer because prosecutors can prove deliberate deception. The catch: the civil False Claims Act doesn’t require specific intent to defraud. Liability attaches when someone acts with “deliberate ignorance” or “reckless disregard” of whether a claim is true. Sloppy billing you should have caught can produce serious consequences even without a plan to cheat anyone.
Civil Money Penalties
The Civil Monetary Penalties Law lets the Department of Health and Human Services impose per-violation fines without going to criminal court. Submitting a false claim for a medical item or service carries a penalty of up to $20,000 per item or service. Kickback violations reach $100,000 per act, and false records or statements can also hit $100,000 per violation.1Office of the Law Revision Counsel. 42 USC 1320a-7a – Civil Monetary Penalties On top of the per-violation fines, the government can assess damages of up to three times the amount fraudulently claimed.
These penalties compound fast. A provider who submits hundreds of improperly coded claims doesn’t face a single penalty; each claim is a separate violation. A pattern of upcoding across dozens of patients over several years can produce liability that dwarfs whatever extra revenue the inflated codes generated in the first place.
False Claims Act Exposure
The False Claims Act is the government’s most powerful civil tool against healthcare fraud, and it gets used constantly. It imposes liability on anyone who knowingly submits a false claim to a federal healthcare program, and “knowingly” is broader than most people expect: it covers actual knowledge, deliberate ignorance, and reckless disregard of accuracy.
Financial exposure under the Act has two parts. The government recovers three times the damages it sustained from the false claims, and each false claim carries a per-claim penalty that is adjusted annually for inflation. As of mid-2025, that penalty runs from $14,308 to $28,619 per false claim.2Federal Register. Civil Monetary Penalties Inflation Adjustments for 2025 A billing operation that submitted thousands of fraudulent claims can face per-claim penalties alone reaching tens of millions of dollars.
Whistleblowers Change the Math
The False Claims Act includes a qui tam provision that lets private citizens, often current or former employees, file suit on behalf of the government. Whistleblower cases account for a large share of healthcare fraud recoveries. The financial incentive is real: if the government joins the case, the whistleblower receives between 15% and 25% of what the government recovers. If the government declines to intervene and the whistleblower pursues the case alone, the share rises to between 25% and 30%.3Office of the Law Revision Counsel. 31 USC 3730 – Civil Actions for False Claims Many healthcare fraud cases start with a billing specialist or coder who notices something wrong and decides to speak up, and federal law protects those reporters from retaliation.
Criminal Prosecution
When coding fraud involves willful deception, the Department of Justice can pursue criminal charges. The primary federal healthcare fraud statute carries a maximum sentence of 10 years in prison. If the fraud results in serious bodily injury to a patient, the maximum jumps to 20 years. If someone dies as a result, the sentence can be life imprisonment.4Office of the Law Revision Counsel. 18 USC 1347 – Health Care Fraud Individual fines can reach $250,000 per offense.
These aren’t theoretical figures. A Texas orthopedic surgeon was sentenced to 102 months in prison and ordered to pay over $13 million in restitution for his role in a $145 million scheme involving fraudulent claims for compound creams prescribed to federal workers.5United States Department of Justice. Texas Doctor Sentenced to 8.5 Years in Prison for $145 Million Health Care Fraud Scheme A telemedicine company owner received 7 years and a $27.9 million restitution order for billing Medicare for unnecessary orthotic braces.6United States Department of Justice. Telemedicine Company Owner Sentenced to 7 Years in Prison for $56M Medicare Fraud Scheme
Kickback Charges Often Ride Along
Coding fraud regularly overlaps with kickback arrangements, where providers receive payments for referring patients or ordering specific services. The Anti-Kickback Statute makes it a felony to knowingly solicit, receive, offer, or pay anything of value to induce referrals for services covered by federal healthcare programs. Violations carry up to $100,000 in fines and 10 years in prison per offense.7Office of the Law Revision Counsel. 42 USC 1320a-7b – Criminal Penalties for Acts Involving Federal Health Care Programs A conviction leaves a permanent criminal record that makes future healthcare employment effectively impossible.
Exclusion From Medicare and Medicaid
For many providers, exclusion from federal healthcare programs is the most devastating consequence because it cuts off a major revenue stream entirely. The Office of Inspector General administers two categories, and the difference matters.
Mandatory Exclusion
The OIG is required by law to exclude anyone convicted of certain offenses, including Medicare or Medicaid fraud, patient abuse or neglect, felony healthcare fraud, and felony controlled-substance convictions. The minimum exclusion is five years for a first offense. A second conviction extends the minimum to 10 years. A third or subsequent conviction results in permanent exclusion.8U.S. Department of Health and Human Services, Office of Inspector General. Exclusion Authorities
Permissive Exclusion
The OIG can also exclude on broader grounds at its discretion, including misdemeanor healthcare fraud convictions, submitting false claims, kickback arrangements, providing unnecessary or substandard services, and losing a state professional license for reasons related to competence or financial integrity.9U.S. Department of Health and Human Services, Office of Inspector General. Background Information on Exclusions Permissive exclusions don’t carry the same mandatory minimums, but they can still last years and effectively end a career.
Employers Take the Hit Too
Exclusion isn’t only an individual problem. Healthcare organizations that employ or contract with an excluded person face civil money penalties of up to $10,000 for each item or service that excluded person furnishes, plus an assessment of up to three times the amount claimed.10U.S. Department of Health and Human Services, Office of Inspector General. The Effect of Exclusion From Participation in Federal Health Care Programs The organization itself can face exclusion as well. That is why hospitals and clinics screen against the OIG exclusion list before every hire and contract renewal.
Licensing, Certification, and Data Bank Consequences
State licensing boards can suspend or revoke a healthcare professional’s license based on fraud-related conduct, and these actions operate independently of any federal prosecution or exclusion. A provider who settles a civil case and avoids criminal charges can still lose their license if the state board finds dishonesty or incompetence. State-level fines for billing misconduct vary but can reach $10,000 or more per count.
Certification bodies, including those that credential medical coders, can also revoke certifications, which removes your ability to work in the field even if your state license survives. These actions tend to cascade. A federal exclusion often triggers a state licensing investigation, and a license revocation can itself become a basis for permissive federal exclusion.9U.S. Department of Health and Human Services, Office of Inspector General. Background Information on Exclusions
Federal and state attorneys, along with health plans, must report healthcare-related civil judgments, including judgments involving fraudulent billing and false claims, to the National Practitioner Data Bank.11National Practitioner Data Bank. Reporting Health Care-Related Civil Judgments These reports never expire. Every hospital, clinic, and health plan checks the NPDB during credentialing and hiring, so a single report can block privileges, employment, and insurance panel participation for the rest of a career.
Corporate Integrity Agreements
Healthcare organizations that settle fraud cases with the government often must enter into a Corporate Integrity Agreement with the OIG. A CIA functions as a five-year probation with heavy operational requirements: a compliance officer, training programs, screening of all employees against exclusion lists, and reporting of overpayments, internal investigations, and other compliance events to the OIG.12Office of Inspector General, U.S. Department of Health and Human Services. Corporate Integrity Agreements
The most expensive requirement is usually the Independent Review Organization, which conducts annual audits of the organization’s billing and coding. The OIG doesn’t maintain a list of approved IROs, so the organization must find and pay for a qualified accounting firm, law firm, or consultant on its own.13Office of Inspector General, U.S. Department of Health and Human Services. Corporate Integrity Agreement FAQs If the IRO identifies overpayments, the organization must repay them within 60 days and may owe extrapolated amounts based on the sample findings. Missed CIA obligations trigger stipulated daily penalties, and repeated noncompliance can result in exclusion from federal programs entirely.
Commercial Insurance Fallout
Federal exclusion gets the most attention, but private insurers impose their own consequences. Most commercial insurance contracts allow the insurer to terminate a provider’s contract immediately on a finding of fraud, bypassing the usual notice and hearing that apply to other termination reasons. Insurers can also recoup past payments by offsetting against future claims, and the usual time limits on recoupment often don’t apply to fraud-related overpayments.
Losing commercial contracts compounds the damage from federal exclusion. A provider who can’t bill Medicare, Medicaid, or any major commercial insurer has no meaningful way to sustain a practice, and the financial collapse tends to be total rather than gradual.
Reducing the Damage Through Self-Disclosure
The OIG operates a Self-Disclosure Protocol that lets providers report potential fraud before the government finds it independently. Self-disclosure doesn’t eliminate consequences, but it typically produces significantly reduced penalties. The OIG generally applies a damages multiplier of 1.5 times the single damages amount in SDP settlements, compared with the treble damages standard under the False Claims Act and CMPL.14Office of Inspector General, U.S. Department of Health and Human Services. Health Care Fraud Self-Disclosure Self-disclosure also avoids the cost and disruption of a full government investigation.
For potential Stark Law violations involving physician referral arrangements, CMS runs a separate Self-Referral Disclosure Protocol with its own submission process.15CMS. Self-Referral Disclosure Protocol Neither protocol guarantees a favorable outcome, and both require a thorough internal investigation before submission. A provider who self-reports negotiates from a fundamentally different position than one who gets caught, and enforcement agencies treat the two very differently.