Dan Nandan is the CEO of Staffingly, Inc. With 25+ years in IT consulting and a decade leading healthcare BPO operations across India, Latin America, and Pakistan, his team now serves 800+ U.S. healthcare providers across medical, dental, pharmacy, and post-acute care verticals.
2026 Compliance Verified: HIPAA, SOC 2 Type II, ISO 27001, HITRUST-aligned workflows.
Featured in Computerworld →
State of Illinois. Registered Professional Nurse
Bincy Shiiju Kuriakose is a U.S.-licensed Registered Nurse (MSN, RN), NCLEX-RN certified, with expertise in hospital nursing, telehealth, and nursing education. She reviews every publication for medical accuracy, YMYL compliance, and evidence-based clinical context.
What Is Medical Coding Compliance With Healthcare Regulations?
Medical coding compliance is the practice of assigning ICD-10-CM, CPT, and HCPCS Level II codes in a way that follows HIPAA transaction standards, CMS coding guidelines, the False Claims Act, and OIG compliance program guidance. Coders are the first line of defense: when codes match the documentation, claims pay cleanly; when they do not, the practice faces denials, payer audits, and federal liability.
Why Coding Compliance Matters More in 2026 Than Ever Before
The federal government is spending more money on healthcare fraud enforcement than at any point in history. And it is working.
HHS-OIG identified over $16.6 billion in healthcare fraud, overpayments, and improper payments in its Spring 2025 Semiannual Report to Congress. Whistleblowers filed a record 1,297 qui tam lawsuits in FY 2025, earning over $262 million in payouts (DOJ). In January 2026, Kaiser Permanente paid $556 million to settle allegations of submitting unsupported diagnosis codes for Medicare Advantage enrollees. That is the largest MA-related FCA settlement in history.
Medical coders are the first line of defense. When they code correctly, claims pay cleanly. When they do not, the consequences range from denied claims and lost revenue to federal prosecution. The industry benchmark for coding accuracy is 95% (AAPC). Fall below that threshold and your practice faces higher denial rates, payer audits, and compliance risk that compounds every quarter.
Key compliance drivers in 2026:
- DOJ recovered $5.7 billion from healthcare FCA cases in FY 2025 (record)
- OIG explicitly named AI-generated coding prompts as a risk adjustment abuse vector (February 2026 MA ICPG)
- OIG Work Plan targets coding changes during the V24-to-V28 risk adjustment transition
- 487 new ICD-10-CM codes effective October 1, 2025, plus 288 new CPT codes in the 2026 code set
Key Healthcare Regulations Every Medical Coder Must Follow
HIPAA (Health Insurance Portability and Accountability Act)
HIPAA requires standardized code sets for electronic transactions. Medical coders must use current ICD-10-CM, CPT, and HCPCS Level II codes as mandated under the HIPAA Transaction and Code Sets Rule (45 CFR Part 162). Using outdated or incorrect code sets violates HIPAA requirements and can trigger claim rejections.
HIPAA also protects patient health information (PHI). Coders who access medical records for coding purposes must follow minimum necessary standards. They may only view the documentation needed to assign codes. Sharing patient records beyond what coding requires is a HIPAA violation.
False Claims Act (31 U.S.C. 3729-3733)
The False Claims Act is the federal government’s primary tool for prosecuting healthcare billing fraud. Submitting a claim with incorrect codes, whether intentionally or through reckless disregard, can trigger FCA liability. Penalties include treble damages (3x the overpayment) plus $13,946 to $27,894 per false claim (adjusted for inflation, 2025).
The FCA includes a qui tam provision that allows whistleblowers to file lawsuits on behalf of the government. In FY 2025, 1,297 qui tam actions were filed. Coders who observe patterns of upcoding, unbundling, or unsupported diagnosis codes in their organizations are potential whistleblowers. A strong compliance program reduces this risk.
OIG Compliance Program Guidance
The HHS Office of Inspector General publishes compliance program guidance for healthcare organizations. The OIG’s framework includes seven elements that every compliance program should contain: 1. Written policies, procedures, and standards of conduct 2. Compliance officer and compliance committee 3. Training and education 4. Open lines of communication (anonymous reporting) 5. Internal monitoring and auditing 6. Enforcement through disciplinary guidelines 7. Prompt response to detected offenses and corrective action
In February 2026, OIG released updated Medicare Advantage Individual Compliance Program Guidance (MA ICPG) that specifically addresses AI-generated coding prompts as a risk adjustment abuse risk.
CMS Coding Regulations
CMS publishes the ICD-10-CM Official Guidelines for Coding and Reporting, which are mandatory for all providers submitting claims to Medicare and Medicaid. The FY 2026 update includes 487 new diagnosis codes and instructional note changes (Excludes1 to Excludes2 conversions) that alter code selection logic.
CMS also enforces National Correct Coding Initiative (NCCI) edits that prevent improper code combinations. CMS Local Coverage Determinations (LCDs) and National Coverage Determinations (NCDs) define which services are covered and under what conditions. Coders must verify coverage rules before assigning codes.
Building a Coding Compliance Program That Actually Works
A compliance program on paper means nothing if nobody follows it. Here is what a working program looks like.
Step 1: Designate a Compliance Officer Someone in the organization must own compliance. In large groups, this is a full-time Compliance Officer. In small practices, it can be a practice manager or senior coder who takes on compliance responsibilities alongside their primary role. The key is accountability. Someone must monitor OIG alerts, CMS transmittals, and payer policy changes.
Step 2: Write Coding Policies and Update Them Annually Coding policies should cover code selection standards, documentation requirements, modifier usage, query protocols, and how to handle payer-specific rules that conflict with CMS guidelines. These policies must be updated every year when new code sets take effect (ICD-10-CM in October, CPT in January).
Step 3: Train Coders on Regulations, Not Just Code Sets Most compliance training focuses on “don’t upcode” and “don’t unbundle.” That is not enough. Coders need training on the False Claims Act, the Anti-Kickback Statute, HIPAA transaction standards, and the specific OIG compliance elements. Training should happen at onboarding and at least annually, with specialty-specific modules.
Step 4: Run Internal Coding Audits Quarterly Annual audits are too infrequent. Best practice is quarterly audits covering a 10-15% random chart sample per coder. Audits should measure accuracy rate, error type (upcoding, downcoding, unbundling, modifier misuse, diagnosis mismatch), and compare results across coders. Every audit should end with 1-on-1 education, not just a score.
Step 5: Create an Anonymous Reporting Channel The OIG expects organizations to have a way for employees to report compliance concerns without fear of retaliation. This can be as simple as an anonymous email address or a third-party hotline. Remember: 1,297 qui tam lawsuits were filed in FY 2025. If your employees cannot report internally, they may report externally.
Step 6: Respond to Problems Quickly When an audit finds a pattern of errors, the organization must act. Refund overpayments. Retrain the coder. Update the policy. Document the corrective action. The OIG looks favorably on organizations that self-disclose and self-correct.
Save 40-70% with dedicated Healthcare specialists
Book a 15-minute call. We will map your current healthcare outsourcing workflow, denial rates, and staff hours against what a dedicated team typically delivers in the first 30 days.
Most Common Coding Compliance Violations (and How to Prevent Them)
Upcoding Assigning a higher-level code than the documentation supports. Example: billing a 99215 (high-complexity E/M visit) when the documentation only supports a 99214 (moderate complexity). Upcoding is the most common FCA allegation in healthcare. Prevention: audit E/M levels against MDM documentation quarterly.
Unbundling Billing separately for procedures that should be billed as a single bundled code. NCCI edits catch most unbundling at the claim level, but not all. Prevention: run all claims through NCCI edit checks before submission.
Diagnosis Mismatch Assigning a diagnosis code that does not support the procedure performed. Example: coding a skin biopsy with a diagnosis of “routine skin exam” instead of the specific lesion or condition that prompted the biopsy. Prevention: require coders to verify that every procedure code has a supporting diagnosis with documented medical necessity.
Use of Unspecified Codes When Specificity Is Available Defaulting to unspecified ICD-10-CM codes (codes ending in .9) when the provider documented enough detail for a more specific code. CMS guidelines require the highest level of specificity supported by the documentation. Prevention: flag unspecified codes during pre-submission review and query providers when documentation supports a more specific code.
Incorrect Modifier Usage Applying modifiers incorrectly or omitting required modifiers. Modifier 25 (significant, separately identifiable E/M service) is the most frequently misused modifier in the industry. Prevention: include modifier logic in coding policies and audit modifier usage as a separate metric.
Failing to Update Code Sets Billing with outdated ICD-10-CM or CPT codes after new code sets take effect. With 487 new ICD-10-CM codes and 288 new CPT codes in 2026, this is a real risk. Prevention: verify EHR and billing software code sets are updated before October 1 (ICD-10) and January 1 (CPT) each year.
Coding Audits as a Compliance Tool
Coding audits are not punishment. They are the most effective compliance tool a practice has.
Internal Audits
- Frequency: quarterly minimum, monthly for high-risk specialties (cardiology, orthopedics, oncology)
- Sample size: 10-15% of charts per coder per audit cycle
- What to measure: accuracy rate, error type distribution, denial rate by coder, documentation quality score
- Follow-up: 1-on-1 coder education within 7 days of audit results
External Audits
- Hire a third-party coding audit firm annually to provide an independent review
- External auditors catch patterns that internal reviewers may miss due to familiarity
- External audit results can be used to demonstrate compliance to OIG in the event of an investigation. A practice that can produce two years of clean external audit reports with documented corrective actions for any identified issues demonstrates the kind of good-faith compliance effort that OIG considers when determining penalties
Audit Triggers to Watch
- Sudden increase in high-level E/M codes (99214/99215 as a percentage of total)
- Modifier 25 usage above specialty benchmarks
- Diagnosis code patterns that spike after a payer policy change
- AI-generated coding suggestions accepted at 100% rate without human review (this is now an OIG red flag per the February 2026 MA ICPG)
- A single coder’s denial rate diverging significantly from the team average, which may indicate a training gap or a misunderstanding of a specific payer’s coding requirements
The AAPC recommends a 95% accuracy benchmark. Practices that score below 90% on internal audits should escalate to intensive coder education and consider external review. The most effective audit programs track accuracy trends over time rather than treating each audit as an isolated snapshot. A coder whose accuracy drops from 96% to 91% over three consecutive quarters needs intervention before they fall below the threshold. Trending also reveals whether accuracy issues are coder-specific or systemic. When multiple coders show the same error pattern on the same code set, the problem is training or documentation, not individual performance.
State-Specific Compliance Requirements: Georgia, Pennsylvania, Illinois
Georgia: Georgia’s Medicaid Fraud and Patient Protection Division under the Attorney General investigates and prosecutes coding fraud. Georgia participated in a $114.5 million federal judgment from a genetic testing scheme and was named in the 2025 DOJ healthcare fraud takedown. Georgia Medicaid is delivered through managed care organizations, and each MCO conducts its own post-payment coding audits with criteria that may differ from CMS national standards. Coders working GA Medicaid claims must maintain MCO-specific reference materials and track audit findings separately from commercial payer audits. To report suspected Medicaid coding fraud in Georgia, contact the AG’s office at (404) 458-2878 ext. 664.
Pennsylvania: PA DHS updated the Medical Assistance Fee Schedule effective June 16, 2025, adding and end-dating procedure codes per CMS updates. Pennsylvania also adopted Milliman Clinical Guidelines (MCG) for medical necessity screening effective July 18, 2025, replacing previous criteria in several service categories. Coders must align clinical documentation with MCG criteria when coding services that require medical necessity justification. Pennsylvania’s Medicaid program processes over $14.6 billion in annual claims, and the state MFCU (Medicaid Fraud Control Unit) actively investigates billing patterns that suggest upcoding, unbundling, or unsupported diagnoses.
Illinois: Illinois Healthcare and Family Services (HFS) enforces Medicaid coding compliance through its Office of Inspector General. Illinois requires all Medicaid providers to have a compliance plan that includes coding audits. The state’s Medicaid MCOs (Meridian, Molina, CountyCare, YouthCare) each maintain their own coding edit libraries that apply on top of CMS NCCI edits. Coders working IL Medicaid claims must verify that their code combinations pass both the state MCO edits and federal NCCI rules. Illinois enforces a 180-day timely filing limit for Medicaid claims, and claims submitted with incorrect codes after this window cannot be corrected.
Payers increasingly request compliance documentation as part of the credentialing and recredentialing process. A practice that can produce two years of quarterly audit results with accuracy rates above 95 percent demonstrates operational maturity that payers reward with faster credentialing decisions.
Why Outsourcing Coding to a Compliant Partner Reduces Risk
Hiring in-house coders who maintain certifications, track regulatory changes, and pass quarterly audits is expensive. The AAPC estimates a 12% nationwide coder talent gap in 2026, and certified coders with compliance expertise command premium salaries. The shortage is most acute in specialties like cardiology, oncology, and interventional radiology where coding complexity is highest and the pool of qualified coders is smallest. A practice that loses its only certified cardiology coder faces a 60 to 90 day recruiting cycle during which either charts go uncoded or a generalist coder handles specialty claims with predictable accuracy problems.
Outsourcing to a compliant coding partner shifts regulatory burden while maintaining quality. But not all outsourcing partners are equal. The wrong partner increases risk. The right partner reduces it. The key distinction is whether the outsourcing vendor treats compliance as a checkbox or as an operational standard embedded in every coded chart. A vendor that can produce current SOC 2 Type II audit reports, documented coding accuracy rates above 95%, and a signed BAA on file before any data is transferred demonstrates operational compliance. A vendor that cannot produce these documents on request is a compliance liability, not a compliance solution. Ask for these documents before signing any agreement and verify that the SOC 2 Type II report covers the most recent 12-month audit period.
Each specialty has its own high-risk code combinations that trigger payer audits and OIG scrutiny. Cardiology coding requires familiarity with catheterization bundling rules. Orthopedic coding demands precise laterality documentation. Behavioral health coding must account for time-based service codes where documentation of start and stop times determines whether the claim is paid or denied.
What to look for in a compliant coding outsourcing partner:
Accurate medical coding directly affects every downstream revenue cycle function. When codes are wrong, claims get denied, payments get delayed, and compliance risk increases. Practices that invest in trained coders, regular audits, and current code sets see measurable improvements in first-pass claim rates. For practices without the budget to hire full-time certified coders, outsourcing to a medical coding services team provides access to AAPC-credentialed professionals, backed by ongoing coding audit support and modifier audit and compliance review that keeps accuracy above the 95% AAPC benchmark.
