Healthcare fraud enforcement has never been more aggressive and small medical practices are caught in the crossfire whether they’re perpetrators or victims.

In June 2025, the DOJ executed the largest healthcare fraud enforcement operation in U.S. history, charging 324 defendants across 50 federal districts for schemes involving more than $14.6 billion in fraudulent claims. For fiscal year 2025, False Claims Act settlements and judgments reached $6.8 billion the largest annual total in the statute’s history with more than $5.7 billion tied to healthcare. Whistleblowers filed 1,297 qui tam lawsuits, also a record high.

These numbers aren’t just about large hospital systems and organized fraud rings. They include physicians, nurse practitioners, and billing staff at practices of every size. Small medical practice billing fraud takes two distinct forms: fraud committed against the practice by dishonest employees, and fraud inadvertently committed by the practice through billing errors and compliance failures that regulators treat as fraud regardless of intent.

Both are serious. Both are preventable. And for a small practice with limited administrative resources, the protective measures need to be practical not theoretical.

The Two Fraud Threats Every Small Practice Faces

Small medical practice billing fraud is not a single problem. Practices need to defend on two fronts simultaneously.

Internal billing fraud by employees. Billing coordinators, office managers, and medical coders who process claims have significant opportunity to route payments to personal accounts, submit claims for services not rendered, or pocket patient copayments before they’re recorded. This is occupational fraud in a medical context, and it follows the same patterns documented across all industries: a trusted employee with unchecked access, no independent review, and months or years of undetected theft. The ACFE’s 2024 data found that healthcare is among the top five industries by case volume, with a median loss of $100,000 or more per incident.

Compliance based billing fraud. Billing errors upcoding, unbundling, billing for services not properly documented, or submitting claims under incorrect provider credentials can trigger False Claims Act liability even when the practice had no fraudulent intent. The Medicare Fee for Service improper payment rate for fiscal year 2024 was 7.66%, representing approximately $31.7 billion in problematic payments. CMS and HHS OIG use data analytics to flag outlier billing patterns, and a practice whose claims consistently diverge from peers in the same specialty is likely to draw scrutiny regardless of intent.

Understanding both forms is essential to building protections that actually work. Our post on what medical billing fraud actually is and how healthcare fraud investigations work step by step provide important context for each.

Protecting Against Internal Billing Fraud: The Controls That Matter

Internal small medical practice billing fraud thrives under the same conditions as all occupational fraud: one person controlling the full billing cycle with no independent check on their work. A billing coordinator who enters charges, submits claims, posts payments, and reconciles accounts receivable has complete control over every step where money enters the practice and complete ability to divert it.

The most effective internal controls for small practices:

Separate billing from payment posting. The person who submits claims should not be the same person who posts incoming payments. This single separation means that if a payment is intercepted before it’s recorded, the discrepancy will surface when expected payments don’t appear in the accounts receivable record.

Owner or manager review of daily deposits. Practice owners who review daily bank deposits against posted payments even briefly create an independent check that surfaces discrepancies before they accumulate. Most practice management systems generate end of day deposit reports that take minutes to verify.

Reconcile accounts receivable to bank deposits monthly. Expected collections versus actual deposits should be reconciled monthly by someone independent of the billing staff. Unexplained differences between what claims show as paid and what the bank shows as deposited are a direct indicator of diversion.

Conduct periodic claim audits. Randomly select 20 to 30 claims per month and verify that each claim submitted corresponds to a dated, signed clinical note in the patient record. This audit catches both inadvertent billing errors and intentional false claims. It also serves as a deterrent employees who know claims are spot checked are less likely to submit fraudulent ones.

Limit copayment handling. Cash copayments collected at the front desk should be handled by at least two people one who collects and one who records and should be reconciled to the appointment schedule daily. Skimming from cash collections before they’re recorded is one of the simplest and most common small practice fraud schemes.

For any practice where these functions are currently concentrated in one person, adding even one independent review step an external billing reviewer, a part time bookkeeper, or a monthly reconciliation by the physician owner substantially reduces exposure.

Protecting Against Compliance Based Billing Fraud

Compliance failures in small medical practice billing fraud are often invisible to the practice until an audit or investigation begins. The most common patterns that trigger enforcement attention:

Upcoding: Billing for a higher level of service than the documentation supports. A practice that consistently bills 99215 (the highest complexity office visit code) at rates significantly above specialty peers will appear as an outlier in CMS data analytics. Our post on upcoding and unbundling in healthcare billing explains exactly how these patterns are identified.

Unbundling: Billing separately for services that should be billed as a single bundled code. This inflates reimbursement and is specifically identified by payers as fraudulent billing.

Billing under incorrect provider credentials: Claims submitted using the NPI of a supervising physician when a non credentialed provider performed the service, or billing for services performed by a student or unlicensed individual. This was a specific charge category in the 2025 national healthcare fraud takedown.

Services not documented: Any service billed must have a contemporaneous, signed clinical note in the patient record. Billing for services without corresponding documentation regardless of whether the service was actually performed creates False Claims Act exposure.

The standard compliance protection for these risks is a formal compliance program. HHS OIG’s guidelines recommend that every medical practice, regardless of size, maintain:

• A written compliance plan covering billing standards and documentation requirements
• Regular internal coding audits comparing claims to documentation
• A designated compliance contact or officer (this can be the physician owner in a small practice)
• A mechanism for staff to report billing concerns without fear of retaliation

Small practices don’t need a large compliance department they need documented policies, consistent coding audits, and a culture where billing questions get asked rather than ignored. If you’re concerned about what triggers a federal healthcare fraud investigation, the answer most often is outlier billing patterns caught by automated CMS analytics.

When to Bring in Outside Help

There are two specific circumstances when a small practice needs professional assistance beyond internal controls.

Suspected internal fraud. If something in your billing records, deposit totals, or accounts receivable doesn’t add up and your internal review can’t explain it the next step is a forensic accountant with healthcare experience, not a confrontation with the employee. Preserve your billing records and bank statements in their current state, consult an attorney, and allow a professional investigation to establish what happened before any personnel action. Our post on what to do when you suspect employee theft walks through the sequence.

Regulatory inquiry or audit. If your practice receives a Request for Additional Documentation (RAD) from a Medicare Administrative Contractor, an audit notice from HHS OIG, or any other regulatory inquiry, engage healthcare counsel immediately before responding. The way you respond to the initial inquiry significantly affects how the investigation proceeds. Do not attempt to handle a formal audit response without legal guidance.

A third situation also warrants professional review: any practice that hasn’t had an independent coding audit in the past 12 months should commission one proactively. Discovering billing anomalies through your own internal audit and correcting them before a regulator does positions you far more favorably than having errors discovered externally.

Building a Culture That Prevents Fraud

The most durable protection against small medical practice billing fraud isn’t a policy or a software tool it’s a workplace culture where accurate billing is treated as a professional standard, not an administrative burden.

This starts with the physician owner. Practices where the physician demonstrates genuine engagement with billing compliance reviewing claims, asking questions about coding decisions, treating documentation as essential rather than optional create an environment where employees understand that billing integrity is non negotiable.

Practical cultural elements that reduce fraud risk:

• Regular training for all billing and administrative staff on accurate coding, documentation requirements, and the legal consequences of billing fraud
• A clear, confidential reporting mechanism for staff to raise billing concerns how anonymous tips trigger investigations applies equally in medical practices
• Defined consequences for billing errors and deliberate fraud that are communicated to all staff
• Periodic cross training so that no one person is the sole expert on the billing process isolation of knowledge is a fraud enabler

Understanding what types of medical billing fraud doctors can be held responsible for is foundational for any physician owner who delegates billing functions to staff.

Conclusion: Small Practices, Serious Exposure

Small medical practice billing fraud causes real harm to the practice’s finances, its Medicare enrollment, its professional reputation, and in serious cases, its physicians’ licenses and freedom. The enforcement environment in 2025 and 2026 makes clear that regulators have the tools, the data, and the incentive to pursue billing fraud at every scale.

The controls that protect small practices aren’t complicated: separate billing from payment posting, reconcile accounts receivable independently, conduct periodic coding audits, maintain documentation standards, and build a compliance culture that treats accurate billing as fundamental to professional practice.

None of these require large investments. They require intention and consistent follow through.

If your practice already shows signs of potential fraud, act quickly and carefully. Secure your records, consult counsel, and bring in a professional investigator before taking any personnel action. The way you respond in the first 48 hours matters enormously to the outcome.

Frequently Asked Questions

1. What’s the most common form of internal billing fraud in small medical practices? The most common internal schemes involve skimming copayments before they’re recorded, submitting claims for services not rendered and pocketing the reimbursement, and diverting incoming insurance payments to personal accounts before posting them to accounts receivable. All of these exploit single person control over the full billing cycle. Separating claim submission from payment posting is the single most effective control against these schemes.

2. Can a practice be investigated for billing fraud even if errors were unintentional? Yes. The False Claims Act’s “reckless disregard” standard means a practice can face civil liability for systemic billing errors even without proof of intentional fraud. Upcoding patterns, consistent unbundling, or billing for undocumented services can trigger investigation and settlement obligations regardless of whether the practice intended to defraud payers. This is why proactive compliance programs and internal coding audits are essential, not optional.

3. What happens if a practice is found to have submitted false claims to Medicare? Consequences range from repayment obligations and civil penalties under the False Claims Act to exclusion from Medicare and Medicaid participation. Criminal charges wire fraud, healthcare fraud apply when intent can be proven. Exclusion from Medicare participation is often the most operationally devastating consequence for a small practice. Our post on what triggers a federal healthcare fraud investigation explains the typical escalation path.

4. How often should a small practice conduct a billing compliance audit? HHS OIG recommends at least annual internal coding audits for practices of all sizes. Higher risk specialties those with complex coding, high cost procedures, or outlier billing patterns may benefit from quarterly audits. After any significant billing staff change, an audit is also advisable to establish a clean baseline under new personnel.

5. Should a small practice hire a compliance officer? For very small practices, a dedicated compliance officer may not be feasible but the compliance function still needs to be assigned to someone with clear responsibility and authority. Many small practices designate the physician owner or office manager as the compliance contact and supplement with an outside healthcare compliance consultant for annual audits. The key is that someone is accountable for compliance, not that a full time position exists.

6. What should I do if I discover a billing employee has been committing fraud? Preserve all billing records, bank statements, and electronic records in their current state immediately. Consult an attorney before taking any employment action or confronting the employee premature action can destroy evidence and create legal exposure for the practice. Notify your malpractice and fidelity bond insurer according to your policy requirements. Engage a forensic accountant to document the full scope of the loss. See our full guide on what to do when you suspect employee theft.

References

1. U.S. Department of Justice, Office of Public Affairs. (2025). FY 2025 False Claims Act Settlements and Judgments Exceed $6.8 Billion. https://www.justice.gov/opa/pr/fy 2025 false claims act settlements and judgments exceed 68 billion
2. Whitley Penn. (2025). U.S. Healthcare Fraud Takedown 2025. https://www.whitleypenn.com/healthcare fraud takedown 2025/
3. Medical Group Management Association (MGMA). (2026). Preventing Fraud in Your Medical Practice: 2026 Enforcement Trends. https://www.mgma.com/articles/preventing fraud in your medical practice
4. Centers for Medicare & Medicaid Services (CMS). (2024). Fiscal Year 2024 Improper Payments Fact Sheet. https://www.cms.gov/newsroom/fact sheets/fiscal year 2024 improper payments fact sheet
5. U.S. Department of Health and Human Services, Office of Inspector General (HHS OIG). (2024). A Roadmap for New Physicians: Fraud and Abuse Laws. https://oig.hhs.gov/compliance/physician education/fraud abuse laws/
6. HHS OIG. (2023). Compliance Program Guidance for the Health Care Industry. https://oig.hhs.gov/compliance/compliance program guidance/
7. Association of Certified Fraud Examiners (ACFE). (2024). Occupational Fraud 2024: A Report to the Nations. https://www.acfe.com/ /media/files/acfe/pdfs/rttn/2024/2024 report to the nations.pdf
8. White & Case LLP. (2025). Healthcare Fraud Enforcement in 2025: A Year of Aggressive Action and Expanding Risk. https://www.whitecase.com/insight our thinking/healthcare fraud enforcement 2025 year aggressive action expanding risk
9. Cotiviti. (2025). Busted: The Top Healthcare Fraud Schemes of Q4 2024. https://resources.cotiviti.com/fraud waste and abuse/busted the top healthcare fraud schemes of q4 2024
10. Federal Bureau of Investigation (FBI). (2024). Health Care Fraud. https://www.fbi.gov/investigate/white collar crime/health care fraud

Disclaimer: This article is provided for informational and educational purposes only. It does not constitute legal, medical, financial, or professional advice of any kind, and no professional or client relationship is created by reading it. Healthcare billing laws, compliance requirements, and enforcement standards vary by payer, jurisdiction, and practice type. Consult a qualified healthcare attorney, compliance professional, or certified fraud examiner for guidance specific to your situation. For questions about FraudOrder services, visit https://fraudorder.co/