Medical billing is one of the most regulated functions in the American healthcare system. It sits at the intersection of clinical care, insurance reimbursement, patient rights, and federal law, making compliance not just a best practice, but a legal obligation. Errors or intentional violations can result in denied claims, significant financial penalties, exclusion from federal programs, and even criminal prosecution. Whether you are a billing specialist or a patient seeking to understand your rights, this guide covers every major law governing medical billing in the U.S.
CATEGORY 1: Federal Fraud & Abuse Laws
Patient protection and billing transparency are critical aspects of healthcare compliance. The following laws are designed to safeguard patients and ensure honest billing practices.
1. The False Claims Act (FCA) — 31 U.S.C. §§ 3729–3733
The False Claims Act is the federal government’s primary tool for combating fraud in government-funded programs, including Medicare and Medicaid. Enacted during the Civil War in 1863, FCA prohibits any person or organization from knowingly submitting a false claim for payment to the federal government.
What It Covers: Submitting claims for services not rendered, upcoding, unbundling, and billing for medically unnecessary services.
Key Timeframe: Claims must be reported and corrected within 60 days of discovery under the “60-day rule” to avoid FCA liability.
Qui Tam Provisions: Private individuals (“relators” or whistleblowers) can file lawsuits on behalf of the government and receive 15–30% of the recovered funds.
Penalties: Violating the False Claims Act results in $14,308–$28,619 per violation plus triple (3×) the government’s damages.
2. The Anti-Kickback Statute (AKS) — 42 U.S.C. § 1320a-7b(b)
The Anti-Kickback Statute bans offering or receiving anything of value to influence referrals for services covered by Medicare or Medicaid. If a provider intentionally pays something of value to obtain a referral for a patient, then they violate the AKS. Moreover, the claims they submit for that patient violate the False Claims Act (FCA). The provider may face both FCA liability and criminal penalties for the AKS violation.
Penalties: Criminal penalties up to $100,000 per violation and up to 10 years in prison. Civil monetary penalties up to $50,000 per violation plus exclusion from federal healthcare programs.
3. The Stark Law (Physician Self-Referral Law) — 42 U.S.C. § 1395nn
Formally known as the Stark Law, this statute regulates physician referral practices in U.S. healthcare. It prohibits physicians from referring patients to entities for designated health services (DHS) covered by Medicare if they or an immediate family member have a financial relationship with that entity. Such referrals are only allowed if a specific legal exception applies.
Penalties: Denial of payment for improperly referred services, refund of payments already received, civil monetary penalties up to $15,000 per improper claim, and exclusion from Medicare/Medicaid.
4. The Civil Monetary Penalties Law (CMPL) — 42 U.S.C. § 1320a-7a
The Civil Monetary Penalties Law authorizes the Office of Inspector General (OIG) of the Department of Health and Human Services (HHS) to impose administrative civil monetary penalties. These penalties apply to individuals and entities involved in a wide range of fraudulent and abusive billing practices. It serves as a broad enforcement backstop when other statutes may not directly apply.
Timeframe: The OIG has a 6-year statute of limitations to initiate CMPL actions from the date of the violation.
Penalties: Penalties may range from $10,000 to more than $100,000 for each violation, in addition to up to three times the amount of money falsely claimed.
CATEGORY 2: Privacy & Security Laws
Medical billing involves the handling of sensitive patient health information. A suite of federal and state privacy laws govern how that information must be collected, transmitted, stored, and protected.
5. HIPAA — Health Insurance Portability and Accountability Act (1996)
The Health Insurance Portability and Accountability Act of 1996 is one of the most well-known healthcare laws in the United States. For billing purposes, HIPAA has two critical rules. Those are Privacy Rule and the Security Rule, both of which directly govern how protected health information (PHI) is used, disclosed, and secured during the billing cycle.
HIPAA Privacy Rule — 45 C.F.R. Parts 160 and 164
The Privacy Rule establishes national standards for the protection of individually identifiable health information. Covered entities include health plans, healthcare clearinghouses, and most healthcare providers, as well as their business associates must comply.
Minimum Necessary Standard: Covered entities must make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended billing or treatment purpose.
Patient Rights: Patients have the right to access their own health records, request amendments, and receive an accounting of disclosures.
TPO Exception: PHI may be used and disclosed without patient authorization for treatment, payment, and healthcare operations (TPO).
HIPAA Security Rule — 45 C.F.R. Part 164 Subpart C
The Security Rule establishes standards for protecting electronic PHI (ePHI), which includes all electronically transmitted or stored billing data. Covered entities must implement administrative, physical, and technical safeguards.
Administrative Safeguards: Risk analysis, workforce training, designated security officer, contingency plans.
Physical Safeguards: Facility access controls, workstation use policies, device and media controls.
Technical Safeguards: Access controls, audit controls, transmission security (encryption).
HIPAA Enforcement Rule & Breach Notification Rule
The Breach Notification Rule requires covered entities to notify affected individuals within 60 days of discovering a breach of unsecured PHI. Breaches affecting 500 or more individuals must also be reported to HHS and prominent media outlets within 60 days.
Penalties: HIPAA violations are categorized in four tiers. Tier 1 (unknowing): $100–$50,000 per violation. Tier 2 (reasonable cause): $1,000–$50,000. Tier 3 (willful neglect, corrected): $10,000–$50,000. Tier 4 (willful neglect, not corrected): $50,000 per violation, up to $1.9 million per year per violation category. Criminal penalties up to 10 years imprisonment.
6. The HITECH Act — Health Information Technology for Economic and Clinical Health Act (2009)
The HITECH Act is a U.S. federal law enacted in 2009 to promote the adoption and meaningful use of health information technology, particularly electronic health records (EHRs). It strengthens the privacy and security protections of PHI (Protected Health Information) under HIPAA, increases penalties for breaches, and encourages healthcare providers to use electronic systems.
Penalties: HITECH increased the maximum annual penalty cap for identical violations to $1.9 million and required HHS to conduct periodic audits of covered entities and business associates.
CATEGORY 3: Federal Healthcare Program Billing Regulations
Medicare and Medicaid together account for over $1.5 trillion in annual federal healthcare spending. The following are the set of statutes and regulations that govern how providers must bill these programs.
7. Medicare Conditions of Participation (CoPs) — 42 C.F.R. Parts 482–485
Providers and suppliers must meet Medicare’s Conditions of Participation to be eligible to receive Medicare reimbursement. These conditions establish baseline health and safety standards for hospitals, nursing facilities, home health agencies, hospices, and other provider types.
Billing Relevance: Failure to meet CoPs means a provider is not certified and therefore cannot legally bill Medicare for services rendered during a period of non-compliance.
Medical Necessity: CoPs require that services billed to Medicare must be medically necessary and properly documented in the medical record.
Penalties: Providers that fail to meet CoPs face termination from the Medicare program, meaning loss of all Medicare reimbursement.
8. Medicare Timely Filing Requirement — 42 C.F.R. § 424.44
Medicare requires that all claims be submitted within one calendar year (12 months) of the date of service. This is one of the most commonly missed billing requirements and results in billions of dollars in denied claims annually. Medicare allows reopening of claims for revision within 1 year of the initial determination for any reason, 1–4 years for good cause, and up to 4 years for fraud.
9. Medicare Secondary Payer Act (MSP) — 42 U.S.C. § 1395y(b)
The Medicare Secondary Payer Act establishes rules for when Medicare acts as a primary versus secondary payer. It prevents Medicare from paying for services that another insurer, such as an employer group health plan, workers’ compensation, or auto insurance, is responsible for covering first. However, Medicare may make conditional payments while the primary payer situation is being resolved, but must be reimbursed once the primary payer pays.
10. Medicaid Billing Rules — 42 C.F.R. Part 447 & Social Security Act Title XIX
Each state administers its own Medicaid program within federal guidelines established by the Centers for Medicare & Medicaid Services (CMS). Billing rules vary by state, but federal Medicaid law sets minimum standards that all state programs must follow.
Covered Services: States must cover mandatory services (hospital, physician, nursing facility, EPSDT for children) and may cover optional services (dental, vision, prescription drugs).
Documentation Requirements: Providers must maintain records sufficient to disclose the nature and extent of services provided and the fees charged.
Timely Filing: Each state sets its own timely filing deadlines, typically ranging from 90 days to 1 year from the date of service. For example, California’s medical billing time limits follow specific rules that providers must track carefully to avoid claim denials.
Third-Party Liability (TPL): Medicaid is the payer of last resort — all other liable third parties must be billed first.
Penalties: Federal Financial Participation (FFP) can be withheld from states with non-compliant programs. Individual providers face recoupment, exclusion, and FCA liability for false Medicaid claims.
CATEGORY 4: Patient Protection & Billing Transparency Laws
A body of federal and state laws requires providers to be transparent about costs, prohibiting surprise bills, and establishing clear dispute resolution rights. Here are some of the key patient protection and billing transparency laws:
11. The No Surprises Act (NSA) — Effective January 1, 2022
Enacted as part of the Consolidated Appropriations Act of 2021, the No Surprises Act is one of the most significant patient billing protection laws in recent history. It protects patients with private health insurance from receiving unexpected medical bills, known as “surprise bills”. This happens when they receive out-of-network care at in-network facilities or from out-of-network providers in emergency situations.
Scope: Applies to emergency services at any facility, non-emergency services at in-network facilities from out-of-network providers (without prior notice and consent), and air ambulance services from out-of-network providers.
Patient Cost-Sharing: Patients may not be charged more than in-network cost-sharing amounts for covered surprise billing situations.
Good Faith Estimates: Providers must give uninsured or self-pay patients a Good Faith Estimate (GFE) of expected charges at least 3 business days before a scheduled service.
Independent Dispute Resolution (IDR): When providers and insurers dispute out-of-network payment amounts, either party may initiate binding arbitration through a certified IDR entity.
Advanced Explanation of Benefits (AEOB): Health plans must send patients an AEOB before scheduled services when a GFE is received.
Penalties: Providers who violate No Surprises Act requirements face civil monetary penalties up to $10,000 per violation. State agencies may also enforce equivalent state surprise medical billing laws.
Read this blog if you want to learn about How Medical Billing Laws in California Implement No Surprise Bill Act.
12. Transparency in Coverage Rule — 85 Fed. Reg. 72158 (Effective 2022–2024)
The Transparency in Coverage Rule, finalized by CMS and the Departments of Labor and Treasury, requires most group health plans and health insurance issuers to publicly disclose pricing information. While primarily directed at insurers, it significantly affects how billing data is used and disclosed.
Machine-Readable Files: Health plans must post machine-readable files disclosing in-network negotiated rates for all covered services and historical out-of-network allowed amounts. Effective July 1, 2022.
Price Comparison Tool: Plans must offer an online consumer price comparison tool for 500 shoppable services (effective Jan 1, 2023) and all services (effective Jan 1, 2024).
Impact on Billing: Providers must ensure their contracted rates are accurately reported; discrepancies between reported rates and actual billing rates raise compliance concerns.
Penalties: Health plans that fail to meet disclosure requirements face penalties of $100 per day per violation under ERISA and the Public Health Service Act.
13. Hospital Price Transparency Rule — 45 C.F.R. § 180 (Effective January 1, 2021)
CMS’s Hospital Price Transparency Rule requires all hospitals operating in the United States to publicly post their standard charge information in a clear, accessible, and machine-readable format. The rule is designed to help patients understand and compare hospital costs before receiving care. Hospitals must publish a machine-readable file with all standard charges for all items and services, and a consumer-friendly display of standard charges for at least 300 shoppable services.
Penalties: Hospitals with 30 or fewer beds: $300/day (max $109,500/year). Hospitals with more than 30 beds: $10 per bed per day (max $2 million/year). CMS may also post a public notice of non-compliance.
14. EMTALA — Emergency Medical Treatment and Labor Act — 42 U.S.C. § 1395dd
The Emergency Medical Treatment and Labor Act (EMTALA), enacted in 1986, requires Medicare-participating hospitals with emergency departments to screen all patients seeking emergency care. This requirement applies regardless of the patient’s ability to pay or insurance status. It directly impacts billing by defining who must be treated and billed. This applies to all Medicare-participating hospitals with emergency departments and to on-call physicians.
Penalties: Civil monetary penalties up to $119,942 per violation for hospitals and physicians. Hospitals may be terminated from Medicare participation. Private right of action available to patients harmed by EMTALA violations.
CATEGORY 5: Insurance & Payer-Specific Billing Laws
Beyond government programs, there are a combination of federal laws and state insurance regulations that define billing procedures, payment timelines, and dispute rights.
15. ERISA — Employee Retirement Income Security Act — 29 U.S.C. § 1001 et seq.
The Employee Retirement Income Security Act of 1974 governs most employer-sponsored health benefit plans in the United States. ERISA preempts state insurance laws with respect to self-funded employer plans, creating a complex patchwork where billing rules vary significantly depending on whether a patient’s plan is fully insured (state-regulated) or self-funded (ERISA-governed).
Claims Processing Deadlines: ERISA requires urgent care claims be decided within 72 hours, pre-service claims within 15 days (extendable by 15 days for cause), and post-service claims within 30 days (extendable by 15 days).
Appeals Rights: Claimants have the right to an internal appeal and, under the ACA, an external review by an independent organization.
Provider Billing Impact: Providers treating patients covered by ERISA plans must understand the plan’s specific coverage rules, as ERISA preempts state prompt pay laws for self-funded plans.
Penalties: ERISA plans that fail to follow proper claims procedures may be deemed to have waived certain defenses. Plans may be liable for benefits, attorneys’ fees, and equitable relief.
16. State Prompt Pay Laws
All 50 states have enacted prompt pay laws that require private health insurers to pay clean claims within specified timeframes. These laws apply to fully insured plans governed by state law. Federal prompt pay rules apply separately to Medicare and Medicaid claims.
Medicare Prompt Pay: Medicare Administrative Contractors (MACs) must pay 95% of clean claims within 30 days and the remainder within 60 days. Interest is paid on late claims.
Medicaid Prompt Pay: States must pay 90% of clean Medicaid claims within 30 days and 99% within 90 days.
State Variation: State prompt pay timelines for medical billing vary. Common standards include 30 days for electronic claims and 45 days for paper claims, but some states allow up to 45–60 days for electronic and 60–90 days for paper.
Penalties: Late payments accrue interest (1–2% per month in many states). Persistent violations may result in regulatory penalties and loss of the insurer’s license to operate in the state.
17. Affordable Care Act (ACA) Billing Provisions — Pub. L. 111-148 (2010)
The Affordable Care Act introduced provisions that impact medical billing, such as requiring coverage of preventive services without cost-sharing, limiting out-of-pocket expenses, and prohibiting annual and lifetime limits. It also mandates external appeals processes, ensuring patients have the right to challenge denied claims and billing decisions.
Out-of-Pocket Maximum: For plan years beginning in 2024, the ACA limits out-of-pocket maximums to $9,450 for self-only coverage and $18,900 for family coverage. Providers must stop billing patients once these limits are reached.
Penalties: Violation of ACA-required coverage mandates can result in CMS enforcement action, loss of market participation, and patient right-of-action for wrongful denial.
CATEGORY 6: Provider Enrollment & Exclusion Laws
Before a provider can even submit a claim to Medicare or Medicaid, they must be properly enrolled in the program. The following laws ensure that only eligible providers participate and help prevent fraud, abuse, and improper billing practices.
18. OIG Exclusion Authority — 42 U.S.C. § 1320a-7
The Office of Inspector General (OIG) is authorized by statute to exclude individuals and entities from participation in Medicare, Medicaid, and all other federal healthcare programs. Excluded parties may not bill federal healthcare programs for services they provide. The List of Excluded Individuals/Entities (LEIE) is publicly available. Employers and providers must check the LEIE monthly before allowing any individual to participate in billing federal programs.
Mandatory Exclusions: Conviction of Medicare/Medicaid fraud, felony conviction related to patient abuse/neglect, or conviction for a felony relating to healthcare fraud must result in exclusion.
Exclusion Duration: Minimum 5 years for mandatory exclusions; 1–10 years for most permissive exclusions; permanent exclusion is possible for repeat offenders.
Penalties: Employing an excluded individual and billing federal programs for their services results in civil monetary penalties of up to $20,000–$100,000. The employing entity itself may be excluded.
19. Medicare Provider Enrollment — 42 C.F.R. Part 424 Subpart P
All providers and suppliers that wish to bill Medicare must enroll in the Medicare program through the Provider Enrollment, Chain, and Ownership System (PECOS). CMS has the authority to deny or revoke enrollment for providers who do not meet enrollment requirements. Providers must be enrolled and receive a National Provider Identifier (NPI) before billing Medicare. Re-enrollment is required upon certain changes in ownership or practice.
Penalties: Billing Medicare without being properly enrolled constitutes a fraudulent claim under the FCA. CMS may also recoup payments made to improperly enrolled providers.
CATEGORY 7: Medical Bill Debt Collection Laws & Patient Financial Rights
Once a claim has been processed and a patient balance established, the collection of that balance is governed by the following set of federal and state laws.
20. Fair Debt Collection Practices Act (FDCPA) — 15 U.S.C. § 1692 et seq.
The Fair Debt Collection Practices Act regulates the conduct of third-party debt collectors, including medical collection agencies, when collecting consumer debts, including medical bills. Enacted in 1977 and enforced by the Federal Trade Commission (FTC) and Consumer Financial Protection Bureau (CFPB), the FDCPA prohibits abusive, deceptive, and unfair debt collection practices. Within 5 days of initial contact, collectors must provide a written validation notice informing patients of their right to dispute the debt within 30 days.
Penalties: Individual damages up to $1,000 per lawsuit, actual damages, and attorney’s fees. Class action suits may recover up to $500,000 or 1% of the collector’s net worth. CFPB may impose civil money penalties.
21. Surprise Medical Bill — Independent Dispute Resolution & Patient Protections
The No Surprises Act established specific patient rights when it comes to billing disputes for surprise bills. Patients who receive a bill that exceeds the in-network cost-sharing amount for qualifying services may dispute it through the NSA’s dispute resolution process. Patients may initiate a dispute through a certified patient-provider dispute resolution (PPDR) entity if the bill exceeds the Good Faith Estimate by $400 or more.
Timeframe: Patients have 120 calendar days from the date of the initial bill to dispute charges. The PPDR entity must decide within 30 business days.
Penalties: Providers who fail to comply with NSA billing and dispute requirements face $10,000 per violation and potential exclusion from federal programs.
CATEGORY 8: State-Level Medical Billing Laws
In addition to the federal framework, every state maintains its own body of medical billing law. Healthcare billing teams must understand both federal and applicable state requirements.
22. State Balance Billing Protections
Many states have enacted their own balance billing protection laws that extend beyond the federal No Surprises Act. These laws often cover state-regulated plans and may provide stronger protections than federal law. For example, California, New York, Texas, Illinois, and Florida medical billing laws have comprehensive balance billing laws that complement the NSA.
23. State Charity Care & Financial Assistance Laws
Several states require nonprofit hospitals to maintain charity care programs and bill patients according to their ability to pay. These laws directly restrict how hospitals may bill uninsured or underinsured patients.
Examples: California’s Hospital Fair Pricing Act limits what hospitals may charge uninsured patients; New Jersey’s Charity Care law requires hospitals to provide free or reduced care to low-income patients.
IRS Requirements (for 501(c)(3) Hospitals): Nonprofit hospitals must have a written Financial Assistance Policy (FAP), make it publicly available, and limit charges to patients who qualify for assistance.
Penalties: IRS may revoke tax-exempt status for hospitals that fail to maintain required FAPs (26 U.S.C. § 501(r)).
How to Ensure Compliance with Medical Billing Laws
With a legal landscape as complex as medical billing law, compliance is essential. A structured compliance program is essential for any healthcare organization that bills for services. Below is a practical framework for building and maintaining billing compliance.
1. Establish a Formal Compliance Program
The OIG strongly recommends a formal written compliance program. An effective program should follow the OIG’s seven elements:
- Implement written policies and procedures covering all billing and coding activities.
- Designate a Compliance Officer and Compliance Committee with genuine authority.
- Conduct regular training and education for all billing staff, coders, and providers.
- Maintain open lines of communication, including an anonymous hotline for reporting concerns.
- Conduct internal auditing and monitoring of billing practices on a regular basis.
- Enforce compliance standards consistently, including disciplinary action for violations.
- Respond promptly to detected offenses and develop corrective action plans.
2. Conduct Regular Billing Audits
Routine audits are one of the most effective tools for identifying billing errors before they become legal problems. Organizations should implement both pre-submission and post-submission audits.
- Audit E/M coding patterns quarterly to identify outliers compared to national benchmarks.
- Review high-risk billing areas identified annually in OIG’s Work Plan.
- Use statistical sampling to audit at least 5–10% of claims in each major service category.
- Document all audit findings and corrective actions taken.
3. Conduct Monthly LEIE and SAM Checks
Before contracting with any entity involved in billing or providing services to Medicare/Medicaid patients, check the OIG LEIE database and the System for Award Management for federal debarment. Repeat these checks monthly for all existing employees and contractors.
4. Stay Current with Coding Updates
Medical coding is updated annually and, for HCPCS, quarterly. Organizations must:
- Subscribe to CMS update bulletins and AMA CPT update notifications.
- Update billing systems and chargemasters annually before January 1 and October 1.
- Train coding staff on new and revised codes before the effective dates.
- Retire deleted codes immediately on their effective deletion date.
5. Implement HIPAA-Compliant Billing Processes
All billing workflows that involve patient health information must comply with HIPAA’s Privacy and Security Rules. Key steps include:
- Execute Business Associate Agreements (BAAs) with all billing vendors, clearinghouses, and software providers before sharing PHI.
- Conduct an annual HIPAA risk analysis covering all ePHI systems used in billing.
- Implement access controls limiting billing staff access to only the PHI needed for their role.
- Maintain audit logs for all access to billing-related ePHI systems.
- Train all billing staff on HIPAA requirements at hire and annually thereafter.
6. Comply with No Surprises Act Requirements
Since January 1, 2022, providers must:
- Verify patient insurance coverage and network status before scheduling non-emergency services.
- Provide Good Faith Estimates to uninsured/self-pay patients at least 3 business days before scheduled services.
- Obtain signed consent before providing out-of-network services at in-network facilities (when applicable).
- Train front desk and scheduling staff on NSA consent and notice requirements.
7. Post Required Price Transparency Information
Hospital billing departments must ensure compliance with CMS’s Hospital Price Transparency Rule:
- Publish the machine-readable standard charges file on the hospital website.
- Update the file at least annually (on January 1) or within 90 days of a contract change.
- Post the consumer-friendly shoppable services in an easily searchable format.
- Conduct annual audits to verify the completeness and accuracy of posted charges.
8. Establish a Voluntary Disclosure Process
When a billing error is discovered, particularly one that resulted in overpayment from Medicare or Medicaid, the organization must act promptly. Under the 60-day rule, overpayments must be reported and returned within 60 days of identification. The OIG and CMS offer Self-Disclosure Protocols that may result in reduced penalties for organizations that voluntarily come forward.
- Report and return Medicare overpayments within 60 days of identification (not discovery of the error).
- Use the OIG Self-Disclosure Protocol for potential FCA or AKS violations.
- Use the CMS Voluntary Self-Referral Disclosure Protocol (SRDP) for Stark Law issues.
- Document the self-disclosure process thoroughly.
9. Engage Qualified Legal and Compliance Counsel
The complexity of medical billing law, due to spanning federal statutes, CMS regulations, state law, and payer contracts, makes legal counsel essential. Organizations should:
- Retain healthcare compliance counsel familiar with both federal and state billing law.
- Obtain legal review before entering new financial arrangements with referral sources.
- Seek outside counsel to conduct privileged compliance audits in high-risk areas.
- Engage counsel immediately upon receipt of a subpoena, OIG inquiry, RAC audit, or government investigation.
10. Consider Outsourcing Medical Billing
Outsourcing billing to an experienced partner like Transcure can significantly strengthen compliance while improving revenue performance. Key benefits include:
- Dedicated teams stay updated with CMS, OIG, HIPAA, and payer-specific regulations.
- Certified coders and auditors ensure accurate coding and clean claim submission.
- Ongoing monitoring and compliance checks help identify issues before they escalate.
- Immediate implementation of CPT, ICD-10, and HCPCS updates without internal delays.
- Eliminates the need for in-house hiring, training, and compliance program maintenance.
