Healthcare compliance is the framework of internal controls, written policies, training, auditing, and leadership oversight that keeps a healthcare organization operating within federal and state law. It touches how a hospital bills Medicare, how a clinic stores patient records, whether a physician has a financial conflict when ordering a lab test, and whether an emergency department screens every patient who walks through the door. When it fails, penalties can reach millions of dollars a year, and in the worst cases criminal prosecution or permanent exclusion from federal healthcare programs.
The Laws That Define Healthcare Compliance
Several federal statutes form the backbone of the field. They address different risks, but they overlap constantly in practice. A single billing error can draw scrutiny under more than one at once.
HIPAA
The Health Insurance Portability and Accountability Act created the first national standards for protecting patient health information. Its Privacy Rule controls how organizations use and share protected health information and gives patients rights over their own records.1U.S. Department of Health & Human Services (HHS). Summary of the HIPAA Privacy Rule The Security Rule sets separate requirements for electronic PHI, mandating administrative, physical, and technical safeguards.2Centers for Medicare & Medicaid Services. HIPAA Basics for Providers: Privacy, Security, and Breach Notification Rules A separate Breach Notification Rule requires covered entities to notify affected individuals within 60 calendar days when unsecured PHI is improperly accessed or disclosed, with additional notice to HHS and prominent local media when a breach involves 500 or more residents of a state.3U.S. Department of Health & Human Services (HHS). Breach Notification Rule
Anti-Kickback Statute
The Anti-Kickback Statute is a criminal law that prohibits knowingly paying or receiving anything of value to induce referrals for services covered by Medicare, Medicaid, or other federal programs. “Anything of value” is read broadly and reaches free rent, expensive meals, and inflated consulting fees.4U.S. Department of Health and Human Services Office of Inspector General. Fraud and Abuse Laws Violations are felonies carrying fines up to $100,000 and prison sentences up to 10 years.5Office of the Law Revision Counsel. 42 USC 1320a-7b – Criminal Penalties for Acts Involving Federal Health Care Programs
Stark Law
The Physician Self-Referral Law, known as Stark, prohibits physicians from referring Medicare or Medicaid patients for certain designated health services to entities where the physician or an immediate family member has a financial relationship, unless a specific exception applies. Designated services include lab work, imaging, physical therapy, home health, and outpatient prescription drugs, among others. Stark is a strict liability statute: the government does not have to prove intent. If the financial relationship exists and no exception fits, the violation is automatic.4U.S. Department of Health and Human Services Office of Inspector General. Fraud and Abuse Laws
False Claims Act
The False Claims Act targets anyone who knowingly submits a fraudulent claim to the federal government. In healthcare, that usually means billing for services never provided, upcoding to inflate reimbursement, or claiming payment for medically unnecessary procedures. “Knowingly” covers actual knowledge, deliberate ignorance, and reckless disregard of the truth.6Office of the Law Revision Counsel. 31 USC 3729 – False Claims The statute also empowers private whistleblowers to sue on the government’s behalf through its qui tam provision, and the whistleblower shares in any recovery.7Office of the Law Revision Counsel. 31 USC 3730 – Civil Actions for False Claims In fiscal year 2025, False Claims Act settlements and judgments topped $6.8 billion, with the majority of cases originating from whistleblower tips.8United States Department of Justice. False Claims Act Settlements and Judgments Exceed $6.8B in Fiscal Year 2025
EMTALA
The Emergency Medical Treatment and Labor Act requires every hospital with an emergency department to screen and stabilize anyone who arrives seeking care, regardless of insurance status or ability to pay. A hospital cannot delay screening to ask about payment, and it must provide stabilizing treatment within the scope of its capabilities. Violations can bring civil monetary penalties against the hospital and individual physicians, and can end with termination of the hospital’s Medicare provider agreement.9Centers for Medicare & Medicaid Services. State Operations Manual Appendix V – Interpretive Guidelines for EMTALA
OSHA Bloodborne Pathogens Standard
OSHA’s Bloodborne Pathogens Standard requires healthcare employers to maintain an exposure control plan, use engineering controls such as safer needle devices, and provide personal protective equipment at no cost to employees, including gloves, gowns, face shields, eye protection, and ventilation devices.10Occupational Safety and Health Administration. 1910.1030 – Bloodborne Pathogens Training, medical surveillance, and hepatitis B vaccinations for at-risk workers are also required.11Occupational Safety and Health Administration. Bloodborne Pathogens and Needlestick Prevention – Overview
Information Blocking
The 21st Century Cures Act prohibits practices that interfere with the access, exchange, or use of electronic health information. Health IT developers and health information networks face civil monetary penalties of up to $1 million per violation. Providers are held to a different standard: the government must show the provider knew a practice was unreasonable and likely to interfere with information access. HHS has set separate disincentives for providers found to have engaged in information blocking.12ASTP. Information Blocking
What Violations Cost
Penalties scale with the severity of the conduct and with how the organization responds once a problem surfaces.
HIPAA violations follow a four-tier penalty structure tied to culpability. At the lowest tier, where the organization did not know and could not reasonably have discovered the violation, penalties start at $145 per violation. At the highest tier, where the violation resulted from willful neglect and was never corrected, the minimum jumps to more than $71,000 per violation, with a maximum above $2.19 million per violation category per year.13Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
False Claims Act liability compounds quickly. Each false claim carries a civil penalty between $14,308 and $28,619, on top of three times the damages the government sustained.14eCFR. 28 CFR Part 85 – Civil Monetary Penalties Inflation Adjustment A billing scheme involving hundreds of claims can produce liability in the tens of millions. Anti-Kickback convictions add criminal fines up to $100,000 and prison sentences up to 10 years.5Office of the Law Revision Counsel. 42 USC 1320a-7b – Criminal Penalties for Acts Involving Federal Health Care Programs Stark violations result in denial of payment for tainted claims, required refunds, and potential exclusion from federal programs.4U.S. Department of Health and Human Services Office of Inspector General. Fraud and Abuse Laws
The 60-Day Overpayment Rule
When a provider identifies a Medicare or Medicaid overpayment, it must report and return the money to its Medicare Administrative Contractor within 60 days, along with an explanation of what caused it. The obligation carries a six-year lookback, so providers can be held responsible for overpayments received up to six years earlier.15Centers for Medicare & Medicaid Services. Medicare Overpayments Fact Sheet
An organization without internal auditing may never “identify” an overpayment, but deliberate ignorance is not a defense. Failing to report and return a known overpayment can trigger False Claims Act liability, converting a billing mistake into a fraud allegation. The OIG can impose a civil monetary penalty of up to $25,595 for each overpayment a provider knew about and failed to return.13Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
Exclusion From Federal Healthcare Programs
The HHS Office of Inspector General maintains a List of Excluded Individuals and Entities. Anyone on the list is barred from participating in federal healthcare programs. No federal payment can be made for items or services furnished by an excluded person, and the ban reaches salary, fringe benefits, and administrative work, not only direct patient care.16Office of Inspector General. Special Advisory Bulletin on the Effect of Exclusions From Participation in Federal Health Care Programs
The consequences fall on the employer. An entity that arranges for an excluded person to provide services payable by a federal program faces a penalty of up to $20,000 for each item or service, plus an assessment of up to three times the amount claimed.17eCFR. Part 1003 – Civil Money Penalties, Assessments and Exclusions An excluded person who submits claims during exclusion faces the same per-item penalties plus treble damages, and can jeopardize any future reinstatement.16Office of Inspector General. Special Advisory Bulletin on the Effect of Exclusions From Participation in Federal Health Care Programs Reinstatement is not automatic; excluded individuals and entities must apply through a formal process, with no guarantee of approval. That is why routine screening of employees, contractors, and vendors against the exclusion list is one of the most basic compliance obligations a healthcare organization has.
The Seven Elements of an Effective Compliance Program
The OIG has long identified seven elements that regulators expect to see when they evaluate whether an organization took compliance seriously.
- Written policies and procedures documenting the organization’s compliance standards, updated when the law changes.
- A designated compliance officer or committee with real authority to investigate and to report findings to senior leadership and the board.
- Regular, role-specific training so billing staff understand coding rules, clinical staff understand privacy obligations, and everyone can recognize a potential violation.
- Open communication channels, such as a hotline or anonymous reporting system, that let employees raise concerns without fear of retaliation.
- Ongoing auditing and monitoring, including claims audits, medical record reviews, and tracking of unusual billing activity, to catch patterns before regulators do.
- Consistent enforcement, with disciplinary standards applied uniformly regardless of the violator’s position, and in some organizations compliance metrics built into performance evaluations.
- Prompt corrective action when a problem is detected: investigate the scope, fix the root cause, report to the appropriate agency when required, and document everything.
The elements work as a system. Written policies mean nothing without training; training means nothing without monitoring; monitoring means nothing without enforcement. Programs that invest heavily in one element and neglect the others tend to look good on paper and fail under scrutiny.
Who Is Responsible
Compliance is not the compliance officer’s problem alone. Hospitals, clinics, long-term care facilities, and every other healthcare entity carry primary responsibility for building a program that works, but the obligation runs through the organization.
Physicians and clinical staff are accountable for following referral rules, documenting care accurately, and respecting patient privacy day to day. Billing and coding staff carry a disproportionate share of the risk because their work generates the claims federal programs pay. A single coding error may be an honest mistake, but a pattern of errors looks like fraud to an auditor with no other way to tell the difference. Board members and senior executives set the tone. The OIG has been increasingly clear that governing boards should receive regular compliance reports and should be asking hard questions about what those reports show.