Abstract
Hospital payment-integrity risk is often treated as a billing problem discovered after a claim is submitted. That framing is too narrow. The evidence that supports a lawful payment begins earlier, when a health system structures a physician arrangement, accepts a referral, makes a clinical decision, documents a service, assigns a code, releases a claim, interprets a payment, and responds to a credible signal of error. A failure at any one of those points can create an inaccurate claim, an overpayment, a patient-access problem, or potential exposure under the False Claims Act, Anti-Kickback Statute, physician self-referral law, and related Medicare requirements.
This narrative review integrates current federal statutes, regulations, controlling and illustrative federal decisions, agency guidance, and peer-reviewed evidence relevant to U.S. acute-care hospitals and health systems. It distinguishes five legal questions that are frequently collapsed into one: whether an arrangement is permissible, whether a referral is restricted, whether a service is clinically appropriate and covered, whether a claim is accurate and material, and whether a payment must be investigated and returned. The review proposes a Six-Record Integrity Ledger that connects the arrangement, referral, clinical, claim, payment, and resolution records. It assigns four executive decision rights: authorize the arrangement, release or hold the claim, investigate and quantify a payment signal, and refund or disclose and close the matter.
The central finding is that effective assurance depends less on adding another retrospective audit than on preserving contemporaneous evidence across organizational boundaries. Compliance guidance can inform that system, but it does not replace the elements of the governing law or fact-specific legal analysis. Hospitals should build controls that protect truthful billing without deterring legitimate physician alignment, clinically appropriate care, or emergency access. This review is not a 50-state survey and does not provide legal advice.
Keywords: hospital payment integrity; False Claims Act; Anti-Kickback Statute; Stark Law; medical necessity; overpayments; physician compensation; compliance; executive assurance
Executive orientation
The claim is the last visible step
Ignore recurring signals until exposure expands.
Treat every error or denial as fraud.
Introduction: the claim begins before billing
A hospital claim is not simply an invoice. It is the final representation produced by a chain of clinical, contractual, operational, and financial decisions. The chain may begin with a physician employment agreement, medical-director contract, recruitment package, equipment lease, laboratory relationship, service-line joint venture, or vendor incentive. It continues through the referral or order, the clinical record, utilization review, coding, charge capture, claim edits, submission, payment, denial, credit balance, audit, and refund process. The claim is therefore the last visible step in a much larger governance system.
The enforcement environment makes this distinction consequential. The U.S. Department of Justice reported more than $6.8 billion in False Claims Act settlements and judgments for fiscal year 2025, including more than $5.7 billion involving the health care industry. It also reported a record 1,297 qui tam filings. DOJ identified managed care, prescription drugs, and medically unnecessary care as three major areas of continued and expanded health care enforcement [14]. These figures describe enforcement activity, not the prevalence of fraud, and settlements are not holdings or admissions unless their terms say otherwise. They do show that payment representations remain a central point of federal scrutiny.
FY2025 enforcement context
Payment representations remain under federal scrutiny
Hospital leaders face two symmetrical errors. The first is underreaction: treating an arrangement, documentation defect, or recurring credit as an isolated operational issue until it has affected a large claim population. The second is overreaction: equating every denial, documentation disagreement, coding change, or overpayment with fraud. The False Claims Act does not convert ordinary error into fraud. Liability turns on the elements applicable to the asserted theory, including falsity and knowledge and, where applicable, materiality and causation [1,3,4]. Likewise, an arrangement outside an Anti-Kickback Statute safe harbor is not automatically unlawful, and a Stark exception does not immunize an arrangement under other laws [5-8].
The executive task is to build a system that can tell the difference. That system must preserve evidence while decisions are being made, identify patterns without substituting analytics for judgment, protect employees who raise concerns, and move promptly when a credible signal suggests that payments may be wrong. It must also keep payment controls from interfering with emergency screening, stabilization, medically appropriate care, or patient choice.
This review frames payment integrity as an enterprise operating model rather than a compliance-department project. Its organizing thesis is simple: if a hospital cannot connect the business purpose, referral safeguards, clinical basis, claim representation, payment outcome, and resolution decision, it cannot provide reliable executive assurance.
Methods and authority hierarchy
This single-author narrative review used separate legal and empirical searches completed through August 14, 2026. The legal search reviewed the current U.S. Code, electronic Code of Federal Regulations, U.S. Supreme Court decisions, selected federal appellate decisions, and official materials from the Centers for Medicare & Medicaid Services, HHS Office of Inspector General, and Department of Justice. Priority was given to binding statutes and regulations, then controlling case law, then persuasive case law and nonbinding agency guidance. Enforcement announcements were used only as labeled context.
The empirical search used PubMed and targeted citation tracing. Search concepts included hospital or health system with false claims, health care fraud, upcoding, clinical coding, physician self-referral, medical necessity, whistleblowing, speaking up, and audit feedback. English-language peer-reviewed original studies and systematic reviews relevant to U.S. hospitals were prioritized. Studies from other health systems were included only when they addressed generalizable documentation, coding, or organizational behavior. Legal commentary, news, blogs, vendor reports, and unsupported opinion were excluded as evidence.
This was a purposive, reproducible narrative search, not a systematic review or meta-analysis. One author screened and interpreted sources. No formal risk-of-bias tool was applied, and no pooled effect was calculated. The review does not resolve state-law requirements, payer-specific contract terms, or every federal exception and safe harbor. Those issues require current, jurisdiction-specific advice from qualified counsel.
Evidence discipline
Authority rises from context to binding law
One payment, five different legal questions
The phrase payment integrity can conceal distinct legal questions. Separating them is the first control.
Legal architecture
One payment can present five different questions
- 01ArrangementIs the economic relationship permissible?
- 02ReferralIs the referral restricted or safeguarded?
- 03Clinical and coverageWas the service appropriate, covered, and documented?
- 04ClaimWas the claim false, and was it knowingly submitted and material?
- 05PaymentAfter payment, what must be investigated and returned?
1. Is the arrangement permissible?
The federal Anti-Kickback Statute generally prohibits knowingly and willfully offering, paying, soliciting, or receiving remuneration to induce or reward referrals or the generation of business reimbursable by a federal health care program [5]. Remuneration is broader than cash. It can include excessive compensation, free or below-market space, favorable investment terms, sham consulting fees, gifts, or other economic benefits. The statute is intent based. Full compliance with an applicable regulatory safe harbor protects the payment practice from treatment as an Anti-Kickback Statute criminal offense and as a basis for exclusion; failure to satisfy a safe harbor does not, standing alone, establish a violation. An arrangement outside a safe harbor requires a fact-specific assessment of purpose, intent, structure, and safeguards [6,16].
Anti-Kickback Statute violations and Anti-Kickback Statute-based False Claims Act claims also require separate analyses. When a plaintiff uses 42 U.S.C. § 1320a-7b(g) to allege that a claim is false because it resulted from a violation, the First Circuit in Regeneron joined the Sixth and Eighth Circuits in requiring but-for causation. The Third Circuit's Greenfield test instead requires a claim connected to a patient exposed to the unlawful referral or recommendation, but not proof of but-for causation. The First Circuit has also recognized a separate false-representation theory that does not invoke § 1320a-7b(g), although ordinary False Claims Act proof still applies [33-35]. This is a jurisdiction-specific legal question, not a single nationwide test.
For executives, the practical question is not merely whether a contract exists. It is whether the hospital can show a legitimate need, defined services, accountable performance, fair-market-value support where relevant, commercial reasonableness, appropriate approvals, and safeguards against compensation that varies with referrals or federal program business. Those records must exist before payment, not be reconstructed after a subpoena or audit.
2. Is the referral restricted?
The physician self-referral law, commonly called Stark Law, generally prohibits a physician from referring Medicare patients for designated health services to an entity with which the physician or an immediate family member has a financial relationship, unless an exception applies. It also restricts billing for improperly referred services [7,8,17]. Inpatient and outpatient hospital services are included among designated health services, subject to the regulatory definition and payment-related limitations [8].
Stark is structured differently from the Anti-Kickback Statute. It is generally described as a strict-liability referral prohibition once its elements are established, and its exceptions are central to compliance. That does not mean that every technical Stark defect automatically creates False Claims Act liability. A Stark-based false-claim theory still requires the separate elements of the False Claims Act, including the relevant knowledge and materiality analysis. A Stark exception also does not create protection under the Anti-Kickback Statute or state law.
This distinction matters in physician employment, medical-director compensation, call coverage, recruitment, leases, timeshare arrangements, service agreements, value-based arrangements, and post-acquisition integration. The hospital should identify the applicable legal pathway at authorization, monitor the arrangement as performed, and re-review it when compensation, duties, locations, ownership, or referral patterns change.
3. Was the service appropriate, covered, and documented?
Clinical appropriateness, Medicare coverage, and documentation sufficiency overlap, but they are not synonyms. A service may be clinically reasonable yet not satisfy a payer's coverage rule. A covered service may be poorly documented. A complete note does not prove that a service was needed. Medicare generally excludes payment for items and services that are not reasonable and necessary for diagnosis or treatment, subject to the governing benefit and coverage rules [15].
Medical-necessity disputes are especially sensitive because clinical judgment is often probabilistic. In the Eleventh Circuit's hospice-specific AseraCare decision, reasonable expert disagreement alone, without more, does not prove falsity. The court nevertheless recognized potential falsity when a prognosis was not honestly held, records were not reviewed, known information was incorrect, or no reasonable physician could agree. The Third, Ninth, and Tenth Circuits reject a categorical objective-falsehood bar and permit clinical opinions or certifications to be tested under ordinary False Claims Act elements. There is therefore no single nationwide rule [36-39].
The First Circuit's 2025 Omni Healthcare decision adds an actor-specific qualification. In a laboratory-testing case, the court held that a laboratory generally may rely on the ordering physician's medical-necessity determination, with the order serving as evidence against the laboratory's scienter unless rebutted. This is not blanket immunity. Manipulated orders, a scheme that makes testing unnecessary, or other evidence giving the laboratory reason to question the order can change the analysis [40]. The operational response is not to ask a revenue-cycle employee to decide whether a physician was "right." It is to preserve independent clinical review, identify the applicable coverage standard, and determine whether the claim accurately represents what was ordered, furnished, documented, and certified.
4. Was the claim false, knowing, and material?
The False Claims Act reaches several forms of conduct, including knowingly presenting a false or fraudulent claim, knowingly making or using a false record material to a false claim, and knowingly concealing or improperly avoiding an obligation to pay the government [1]. "Knowing" includes actual knowledge, deliberate ignorance, and reckless disregard; specific intent to defraud is not required. Private relators may bring qui tam actions in the name of the United States, subject to statutory procedures [2].
In Universal Health Services v. Escobar, the Supreme Court recognized that an implied-certification theory can support liability in appropriate circumstances, but it emphasized a demanding, fact-specific materiality standard [3]. Materiality is not established merely because the government could refuse payment or because a requirement was labeled a condition of payment. Relevant evidence can include the government's actual payment behavior, the nature of the requirement, and the defendant's representations.
In United States ex rel. Schutte v. SuperValu, the Court held that False Claims Act scienter turns on the defendant's contemporaneous subjective awareness, including actual knowledge, deliberate ignorance, or conscious recklessness, rather than a legally plausible interpretation developed later [4]. The governance implication is direct. Contemporaneous warnings, internal analyses, unresolved coding questions, claim edits, audit findings, and executive decisions can become central evidence. A later legal memorandum cannot erase what decision-makers believed at the time.
5. After payment, what must be investigated and returned?
The Affordable Care Act added a federal duty to report and return certain Medicare and Medicaid overpayments by the applicable deadline [9]. For Medicare Parts A and B, the current regulation provides that an overpayment is identified when a person knowingly receives or retains it, using the False Claims Act knowledge standard. The general deadline is 60 days after identification or the due date of an applicable cost report, whichever is later [10].
The rule also addresses related-payment investigations. When a person has identified an initial overpayment and conducts a timely, good-faith investigation to determine whether related overpayments exist from the same or a similar cause, the deadlines for reporting and returning the initial and related overpayments are suspended until the earlier of the investigation's conclusion and calculation of the aggregate amount or 180 days after initial identification. An overpayment must be reported and returned under this rule if identified within six years of receipt [10]. This current formulation replaced the prior regulatory wording that centered on reasonable diligence and quantification. Policies, training, and legal templates should be updated accordingly.
An overpayment retained after the applicable deadline is an "obligation" for False Claims Act purposes [1,9,10], although False Claims Act liability still requires the elements applicable to the asserted theory. Quantification is no longer part of the regulatory identification definition. A credible signal does not automatically establish an identified overpayment, but knowledge is assessed under actual knowledge, deliberate ignorance, or reckless disregard. Hospitals need a disciplined triage process that distinguishes an allegation, a known single-claim error, an identified overpayment, and a possible related-claim population. Counsel should guide privilege, preservation, sampling, extrapolation, disclosure, and refund methodology when the facts warrant it.
Arrangement and referral risk: governance before the claim
Hospitals increasingly organize care through employment, affiliations, co-management, service-line ventures, telehealth, laboratory and pharmacy relationships, managed-care delegation, and vendor-supported programs. These structures can improve access, coordination, quality, and continuity. They can also create financial incentives that affect where patients are sent, which products are selected, and how services are documented or billed.
Peer-reviewed evidence supports treating these incentives as governance signals, not legal conclusions. In a national Medicare study, hospital ownership of physician practices substantially increased the probability that patients used the owning hospital; the authors also found increased selection of high-cost, low-quality hospitals in some circumstances [24]. Another study found that vertical integration shifted common imaging and laboratory services toward hospital settings and higher Medicare reimbursement [25]. Earlier work on imaging self-referral found higher utilization and episode costs in many examined conditions [26,27]. These associations do not establish remuneration, unlawful intent, a restricted referral, or a false claim. They show why referral independence, patient choice, compensation design, and utilization patterns require monitoring.
A defensible arrangement process should answer five questions before signature:
- What patient-care or operational need does the arrangement solve?
- What services, resources, and performance are actually required?
- How was compensation or other economic value determined?
- Which Stark exception, Anti-Kickback Statute safe harbor, advisory analysis, or other legal rationale applies?
- What facts would require reapproval, suspension, or termination?
The monitoring process should then compare the agreement with performance. Timesheets, deliverables, scheduling data, call logs, meeting records, compensation changes, ownership changes, referral patterns, utilization, and patient-choice documentation may all be relevant. A contract that was defensible when executed can become problematic if services are not performed, compensation drifts, the business structure changes, or operational practice no longer matches the approved facts.
The Fourth Circuit's fact-specific, pre-Escobar Tuomey decision remains an important hospital example because it linked physician compensation, referral value, Stark analysis, and False Claims Act scienter [28]. It should not be reduced to a slogan that all productivity compensation is unlawful. Its governance lesson is narrower and more useful: decision-makers must test the actual economic arrangement, heed credible legal warnings, and document how disputed issues were resolved.
The Fourth Circuit's 2026 Kyer decision distinguishes Tuomey. It held that work relative value unit compensation based on a physician's personally performed services does not take referrals into account merely because more hospital work correlates with more hospital revenue. Referral volume or value must enter the compensation formula as a variable. Conclusory labels, high compensation, health-system subsidies, or claim tables do not by themselves plausibly plead Stark- or Anti-Kickback Statute-based False Claims Act claims [41].
Medical necessity: protect judgment and test the representation
Medical-necessity controls can fail in opposite directions. Weak controls may allow orders, admissions, procedures, or recurring services that lack support. Aggressive utilization controls may pressure clinicians, second-guess reasonable uncertainty, or delay care. A mature program protects both clinical independence and truthful payment representations.
Three records should be reviewed together but assessed separately:
- Clinical basis: the patient's condition, alternatives, risks, expected benefit, and the clinician's contemporaneous reasoning.
- Coverage basis: the benefit category, national or local coverage rule, payer policy, authorization, frequency limit, and other payment conditions.
- Claim support: the order, certification, note, code, modifier, units, place of service, and any attestation submitted or implied.
The distinction is visible in current empirical research. A 2026 study of 4.2 million Traditional Medicare sepsis hospitalizations found that 22.6% of stays assigned a sepsis diagnosis-related group lacked a coded acute organ dysfunction and were classified by the investigators as discordant with Sepsis-3. These stays had markedly lower mortality and were associated with an estimated $114 million in higher annual payments compared with alternative infection classifications [21]. The study did not determine fraud, clinician intent, or legal falsity. It illustrates how a gap between clinical definitions, coding rules, and payment categories can produce both financial and quality-measure consequences.
Clinical judgment and payment evidence
Three records, one representation
of stays assigned a sepsis DRG lacked coded acute organ dysfunction and were classified by investigators as discordant with Sepsis-3
The study did not determine fraud, clinician intent, or legal falsity.
Coding-intensity studies present the same caution. Crespin and colleagues estimated that changes in coding behavior could explain up to two-thirds of the growth in highest-intensity discharges across five states from 2011 to 2019, with large associated payments [20]. Silverman and Skinner found different pneumonia coding patterns by hospital ownership in earlier Medicare data [22]. In Medicare Advantage, Jacobs and Layton estimated materially higher risk scores after beneficiaries switched from Traditional Medicare, consistent with coding-intensity effects [23]. None of these studies proves that a specific claim was false. They show that payment systems create incentives and that aggregate outliers deserve disciplined review.
Controls should therefore begin with targeted, clinically credible questions. Is a diagnosis being documented because it affected care, or because it increases reimbursement? Does the record support the severity level? Are queries nonleading? Do outlier clinicians, service lines, vendors, or coders receive independent review? Are quality metrics, risk scores, and payment categories changing in parallel without a plausible patient-mix explanation?
Intervention evidence suggests that accuracy can improve without assuming misconduct. Targeted education for clinicians and coders reduced the proportion of records requiring coding changes in a single-ward quality-improvement project [29]. A U.S. specialty-clinic study found that repeated feedback improved evaluation-and-management coding accuracy [30]. These are limited, context-specific studies, but they support a learning system that uses audit findings to clarify documentation and coding rather than simply recover dollars.
Claim accuracy and the False Claims Act nexus
A hospital's claim-production system crosses departmental boundaries. Clinicians document; utilization teams apply status and coverage rules; coders translate records; revenue-cycle systems generate charges; compliance and audit teams test patterns; finance posts payments and credits; and legal counsel interprets uncertain requirements. No single function sees the whole representation.
This fragmentation creates predictable failure modes:
- a physician arrangement is approved, but its referral or compensation safeguards are not communicated to operations;
- a clinical documentation query changes a diagnosis without a corresponding change in clinical reasoning;
- an edit is overridden repeatedly with no record of who approved the override;
- a denial trend is treated as payer behavior even when it signals a recurring source defect;
- an internal audit identifies errors in a sample, but related claims are not assessed;
- a credit balance remains unresolved because ownership is split across finance and revenue cycle;
- a vendor controls ordering, coding, or documentation logic without independent validation;
- a legal interpretation is stored in email but not translated into claim edits, education, or monitoring.
The control objective is claim provenance: the hospital should be able to reconstruct the material facts and decisions supporting a claim without relying on personal memory. Provenance is not a demand for perfect documentation. It is a reliable link from the service and arrangement to the representation made to the payer.
Escalation should be driven by risk, not merely dollar value. Relevant factors include patient harm, deliberate conduct, leadership involvement, the number and age of claims, recurrence, prior warnings, concealment, retaliation, effect on federal programs, and whether claims continue while the issue remains unresolved. A small dollar issue can be material if it reveals intentional conduct or broad system failure. A large statistical anomaly may be explainable and lawful. Analytics identify where to ask questions; they do not decide falsity or intent.
After payment: identification, investigation, and return
Hospitals receive payment signals from many sources: denials, payer audits, employee reports, hotline calls, physician concerns, vendor notices, government inquiries, coding reviews, credit balances, patient complaints, litigation holds, data analytics, and acquired-entity diligence. The first governance question is whether the signal is credible enough to require action. The second is who has authority to stop further claims, preserve evidence, and define the investigation.
A reliable response has six stages.
Post-payment response
The operational sequence and legal timing must stay distinct
Triage
Record the allegation or anomaly, source, date, implicated program, service line, arrangement, claim types, and immediate patient or payment risk. Assign an accountable owner and a legal/compliance reviewer. Separate the person who owns revenue performance from the person who decides whether claims should continue.
Containment
Decide whether to hold claims, suspend an arrangement, change an edit, preserve data, notify a vendor, or protect patients while the facts are assessed. A hold should be targeted. A broad freeze can create access and cash consequences, while an unjustified decision to continue billing can expand exposure.
Investigation
Define the question, authoritative criteria, data population, interviews, documents, and decision timeline. Preserve competing evidence, including facts that support payment. A good-faith investigation is not a search for a predetermined refund. It tests whether an overpayment exists and whether related overpayments may arise from the same or a similar cause.
Quantification
Identify the affected population and calculate the amount using a defensible method. The method may require claim-by-claim review, valid sampling, extrapolation, cost-report adjustment, or coordination with a payer. Statistical expertise and counsel are important when the population is large or heterogeneous.
Resolution
Choose the appropriate claim adjustment, refund, credit-balance process, cost-report correction, payer notification, OIG Health Care Fraud Self-Disclosure Protocol, CMS Voluntary Self-Referral Disclosure Protocol, or other route [18,19]. Disclosure is not automatic. The decision depends on the authority, conduct, program, evidence, and procedural consequences.
Closure
Document repayment, remediation, accountability, education, system changes, validation testing, and the person or committee authorized to close the matter. Closure should address recurrence. Returning money without fixing the source is not assurance.
The current overpayment rule makes chronology important. Hospitals should record when a signal arrived, when knowledge was established, when related-overpayment investigation began, what made the investigation timely and in good faith, when the population and amount were determined, and when the payment was returned [10]. Policies that use older regulatory language should be revised before they are relied on.
The Six-Record Integrity Ledger
The proposed Six-Record Integrity Ledger is an evidence-informed assurance framework, not a new legal standard or a validated anti-fraud intervention. It connects the evidence already produced by contracting, operations, clinical care, revenue cycle, finance, compliance, and legal functions. Each record has an accountable owner, minimum evidence, a release or hold decision, and an escalation threshold.
Centerpiece framework
The Six-Record Integrity Ledger
Record 1: the arrangement record
The arrangement record explains why the relationship exists and why its economics are defensible. It includes the legitimate purpose, parties, ownership, authority, written terms, scope, duration, compensation methodology, fair-market-value support where applicable, commercial-reasonableness analysis, applicable exception or safe-harbor analysis, approvals, and conditions requiring re-review.
The executive question is: May the hospital authorize this arrangement on these facts?
The record should not be closed at signature. Performance evidence, amendments, renewals, compensation changes, and deviations remain part of the file. An arrangement without proof of performance is an unresolved risk even if the contract language is strong.
Record 2: the referral record
The referral record protects professional independence and patient choice. It includes ordering or referral pathways, choice disclosures, steering restrictions, conflicts, volume-or-value safeguards, referral and utilization trends, and any exception-specific requirements. Monitoring should compare patterns with a clinically and operationally plausible baseline.
The executive question is: Do the referral conditions remain independent and consistent with the approved arrangement?
An outlier is a reason to review, not proof of misconduct. Reviewers should account for geography, specialty, network design, call coverage, service availability, patient preference, and legitimate integration benefits.
Record 3: the clinical record
The clinical record supports the patient-specific need and what was actually furnished. It includes the order, diagnosis, severity, treatment alternatives, expected benefit, relevant coverage basis, certifications, clinical response, and documentation queries. The hospital should preserve clinical-review independence and distinguish clinical disagreement from unsupported documentation.
The executive question is: Does the record support the service and the representation that will be made about it?
This record is where patient safety and payment integrity meet. A service can be nonpayable without being clinically inappropriate, and a clinical error can exist without a false claim. The response must fit the problem.
Record 4: the claim record
The claim record links the service to the submitted representation. It includes codes, modifiers, units, place of service, dates, claim edits, overrides, certifications, medical-necessity support, related arrangement or referral flags, and the identity of the person or rule that released the claim.
The executive question is: Should the claim be released, corrected, or held?
High-risk overrides should require a reason code and accountable approval. Repeated overrides, late documentation, vendor-generated codes, and material changes after discharge should be monitored as patterns.
Record 5: the payment record
The payment record compares the expected and actual outcome. It includes allowed and paid amounts, duplicates, credits, denials, recoupments, rebills, coordination-of-benefits results, cost-report implications, and pattern detection. Reconciliation should connect payer behavior to source claims and to the arrangement or service line when relevant.
The executive question is: Does the payment create a credible signal that requires investigation?
Credit balances deserve particular discipline because they can age outside the attention of the original claim owner. The ledger should assign aging thresholds, escalation, and closure evidence.
Record 6: the resolution record
The resolution record begins when a credible signal is escalated. It captures triage, containment, preservation, legal and clinical criteria, investigation steps, related-claim analysis, quantification, refund or disclosure decision, remediation, validation, and board or committee closure.
The executive question is: Has the hospital investigated, returned or disclosed as appropriate, corrected the source, and tested recurrence?
The resolution record should include dissent and uncertainty. A clean chronology is more credible than a file that contains only the final conclusion.
Together, the six records support four explicit decision rights:
- Authorize the arrangement. Legal, compliance, finance, operations, and the accountable business owner confirm the approved facts and safeguards.
- Release or hold the claim. Clinical, utilization, coding, and revenue-cycle leaders apply documented criteria, with independent escalation for high-risk disputes.
- Investigate and quantify. Compliance and legal functions can open a protected review, require data, define the related population, and recommend containment.
- Refund or disclose and close. Designated executives or a committee approve the resolution based on the governing authority, evidence, remediation, and validation.
Board assurance
Measure the integrity system, not a decorative score
Executive operating model and board assurance
HHS OIG's General Compliance Program Guidance describes seven familiar elements, including written standards, compliance leadership, training, communication, enforcement, auditing, and response. OIG expressly identifies the guidance as voluntary and nonbinding [11]. DOJ Criminal Division's September 2024 Evaluation of Corporate Compliance Programs asks whether a program is well designed, adequately resourced and empowered, and effective in practice. DOJ's March 10, 2026 Department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy separately addresses corporate criminal self-disclosure, cooperation, and remediation [12,13]. These are prosecutorial policy materials, not health care payment rules, False Claims Act safe harbors, or substitutes for OIG and CMS disclosure processes.
For payment integrity, effectiveness can be tested through concrete evidence:
- Does compliance have independent access to the board and authority to obtain data?
- Can the organization identify all active physician and referral-sensitive arrangements?
- Are legal assumptions translated into operational controls and monitoring rules?
- Are coding, utilization, and referral outliers reviewed by qualified, independent personnel?
- Can a credible signal trigger a targeted claim hold without revenue-owner approval?
- Are investigation dates, affected populations, refund decisions, and remediation recorded?
- Are employees protected from retaliation, including subtle changes in duties or performance expectations?
- Does compensation reward compliant performance and impose consequences for misconduct or supervisory failure?
- Are acquired entities, vendors, laboratories, and delegated partners included in risk assessment and monitoring?
- Does the board receive leading indicators, overdue actions, and unresolved disagreements rather than only training completion and audit counts?
Whistleblower evidence reinforces the importance of credible internal channels. In a qualitative study of 26 relators in successful pharmaceutical fraud cases, most insiders first tried to raise concerns internally, and many described serious professional, financial, and health consequences [31]. The study is small and not hospital specific, but it challenges the assumption that financial awards are the primary reason employees report. A 2024 systematic review of 45 hospital speaking-up studies found interacting individual, relational, contextual, and organizational influences [32]. Reporting systems therefore require more than a hotline. They need responsive leaders, anti-retaliation monitoring, feedback, fair investigation, and evidence that raising a concern can change a decision.
Board reporting should focus on the integrity system rather than active-case details that would impair privilege or confidentiality. Useful measures include arrangement re-reviews completed on time, unsupported performance records, high-risk claim overrides, repeat coding findings, unresolved credit balances, days from credible signal to triage, good-faith investigations approaching 180 days, refund timeliness, recurrence testing, substantiated retaliation, and overdue corrective actions. Trend and concentration matter more than a single target number.
Disclosure, remediation, and patient-access safeguards
Payment integrity must not become a reason to withhold necessary care or discourage clinicians from documenting legitimate acuity. Controls should state that emergency screening and stabilization obligations remain independent of ability to pay, prior authorization, network status, or retrospective payment concerns. For EMTALA-required items and services, Medicare reasonable-and-necessary determinations must be based on information available to the treating physician or practitioner when the service was ordered or furnished, including the presenting symptoms or complaint, and not on the patient's principal diagnosis [15].
Likewise, physician alignment and value-based care are not inherently suspect. Federal regulations include exceptions and safe harbors designed for qualifying arrangements. The governance task is to ensure that the facts, documentation, and safeguards match the pathway being used. Patient choice, access, quality, and equity should be monitored alongside utilization and payment.
When an issue is substantiated, remediation should reach the source. Possible actions include contract amendment or termination, compensation correction, claim edits, clinical and coding education, vendor controls, access redesign, personnel accountability, enhanced monitoring, repayment, and disclosure. Counsel should direct decisions involving privilege, government contact, sampling, and state or contractual obligations.
Limitations
This review is narrative and purposive. It did not search every legal database, payer rule, or clinical specialty, and one author performed screening. No formal study-quality instrument or pooled analysis was used. Several empirical studies were observational, used administrative claims, or arose outside U.S. hospitals; association does not establish legal falsity, intent, causation, or materiality. Medical-necessity and Anti-Kickback Statute causation standards vary among federal circuits. This is not a 50-state survey. State false-claims, anti-kickback, self-referral, fee-splitting, corporate-practice, Medicaid, and commercial-payer rules may be broader than federal law. Authorities and enforcement policies should be refreshed immediately before publication and applied with local counsel.
Conclusion
The claim is the last step, not the beginning, of hospital payment integrity. A health system cannot assure truthful reimbursement by auditing codes alone. It must connect the arrangement, referral, clinical judgment, claim, payment, and resolution evidence that produced the claim and its final disposition.
The Six-Record Integrity Ledger gives boards and executives a practical way to assign ownership and decision rights without collapsing every defect into fraud. It protects two obligations at once: the duty to submit and retain only supportable payments, and the duty to preserve legitimate clinical judgment, physician alignment, patient choice, and access to care. The decisive measure is not whether the organization has a compliance program on paper. It is whether the organization can show, contemporaneously and credibly, why it authorized, billed, investigated, refunded, and closed.
Acknowledgments
The author thanks the clinicians, compliance professionals, revenue-cycle leaders, legal counsel, auditors, and patient advocates whose work informs practical payment-integrity governance.
Publication statements
Funding: No external funding was received for this review.
Conflicts of interest: The author declares no conflict of interest.
Ethics review: Not applicable. This article did not involve human participants or identifiable patient data.
Data sharing: No new dataset was created. All sources are publicly available through the cited publications and official authorities.
Disclaimer: This article is for executive education. It is not legal, regulatory, clinical, reimbursement, labor, accounting, insurance, or investment advice. Organizations should obtain fact-specific advice from qualified counsel and applicable clinical, coding, compliance, and financial experts.
References
- 31 U.S.C. § 3729. False claims. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section3729
- 31 U.S.C. § 3730. Civil actions for false claims. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section3730
- Universal Health Services, Inc. v. United States ex rel. Escobar, 579 U.S. 176 (2016). https://www.govinfo.gov/app/details/USREPORTS-579/USREPORTS-579-176
- United States ex rel. Schutte v. SuperValu Inc., 598 U.S. 739 (2023). https://www.supremecourt.gov/opinions/22pdf/21-1326_6jfl.pdf
- 42 U.S.C. § 1320a-7b(b), (g). Criminal penalties for acts involving Federal health care programs. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1320a-7b
- 42 C.F.R. § 1001.952. Exceptions and Anti-Kickback Statute safe harbors. https://www.ecfr.gov/current/title-42/chapter-V/subchapter-B/part-1001/subpart-C/section-1001.952
- 42 U.S.C. § 1395nn. Limitation on certain physician referrals. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1395nn
- 42 C.F.R. §§ 411.350-411.389. Financial relationships between physicians and entities furnishing designated health services. https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-411/subpart-J
- 42 U.S.C. § 1320a-7k(d). Reporting and returning of overpayments. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1320a-7k
- 42 C.F.R. § 401.305. Requirements for reporting and returning of overpayments. https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-A/part-401/subpart-D/section-401.305
- U.S. Department of Health and Human Services, Office of Inspector General. General Compliance Program Guidance. November 2023. https://oig.hhs.gov/compliance/general-compliance-program-guidance/
- U.S. Department of Justice, Criminal Division. Evaluation of Corporate Compliance Programs. September 2024. https://www.justice.gov/criminal/criminal-fraud/page/file/937501
- U.S. Department of Justice. Department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy. March 10, 2026. https://www.justice.gov/criminal/corporate-enforcement
- U.S. Department of Justice. False Claims Act settlements and judgments exceed $6.8 billion in fiscal year 2025. January 16, 2026. https://www.justice.gov/opa/pr/false-claims-act-settlements-and-judgments-exceed-68b-fiscal-year-2025
- 42 U.S.C. § 1395y(a)(1)(A), (d); Centers for Medicare & Medicaid Services. Medical review and education. https://www.cms.gov/data-research/monitoring-programs/medicare-fee-service-compliance-programs/medical-review-and-education
- U.S. Department of Health and Human Services, Office of Inspector General. General questions regarding certain fraud and abuse authorities. https://oig.hhs.gov/faqs/general-questions-regarding-certain-fraud-and-abuse-authorities/
- Centers for Medicare & Medicaid Services. Physician self-referral. https://www.cms.gov/medicare/regulations-guidance/physician-self-referral
- U.S. Department of Health and Human Services, Office of Inspector General. Health Care Fraud Self-Disclosure Protocol. https://oig.hhs.gov/compliance/self-disclosure-info/self-disclosure-protocol/
- Centers for Medicare & Medicaid Services. Voluntary Self-Referral Disclosure Protocol. https://www.cms.gov/medicare/regulations-guidance/physician-self-referral/self-referral-disclosure-protocol
- Crespin D, Dworsky M, Levin J, Ruder T, Whaley CM. Upcoding linked to up to two-thirds of growth in highest-intensity hospital discharges in 5 states, 2011-19. Health Affairs. 2024;43(12):1619-1627. doi:10.1377/hlthaff.2024.00596.
- Ryan AM, Prescott HC, Lin Y, Rooke-Ley H, Buxbaum JD. The association between sepsis coding and payment to U.S. hospitals. Health Services Research. 2026;61(3):e70135. doi:10.1111/1475-6773.70135.
- Silverman E, Skinner J. Medicare upcoding and hospital ownership. Journal of Health Economics. 2004;23(2):369-389. doi:10.1016/j.jhealeco.2003.09.007.
- Jacobs PD, Layton TJ. Identifying coding intensity in Medicare Advantage through switchers. Health Services Research. 2025;60(5):e14628. doi:10.1111/1475-6773.14628.
- Baker LC, Bundorf MK, Kessler DP. The effect of hospital/physician integration on hospital choice. Journal of Health Economics. 2016;50:1-8. doi:10.1016/j.jhealeco.2016.08.006.
- Whaley CM, Zhao X, Richards M, Damberg CL. Higher Medicare spending on imaging and lab services after primary care physician group vertical integration. Health Affairs. 2021;40(5):702-709. doi:10.1377/hlthaff.2020.01006.
- Hughes DR, Bhargavan M, Sunshine JH. Imaging self-referral associated with higher costs and limited impact on duration of illness. Health Affairs. 2010;29(12):2244-2251. doi:10.1377/hlthaff.2010.0413.
- Levin DC, Rao VM. The effect of self-referral on utilization of advanced diagnostic imaging. AJR American Journal of Roentgenology. 2011;196(4):848-852. doi:10.2214/AJR.10.5823.
- United States ex rel. Drakeford v. Tuomey Healthcare System, Inc., 792 F.3d 364 (4th Cir. 2015). https://www.govinfo.gov/content/pkg/USCOURTS-ca4-13-02219/pdf/USCOURTS-ca4-13-02219-0.pdf
- Radhakrishnan ST, Perry R, Misra S, Ray S, Ruban A, Quayson BI, Fofaria R, Hudovsky A, Williams HRT. Targeted education for clinicians and clinical coding staff improves the accuracy of clinical coding: a quality improvement project. Future Healthcare Journal. 2024;11(1):100127. doi:10.7861/fhj.2023-0021.
- Gill AS, Menjivar D, Shipman P, Sumsion J, Error M, Alt JA. Healthcare provider feedback improves outpatient E/M billing and coding in otolaryngology clinics. OTO Open. 2023;7(1):e20. doi:10.1002/oto2.20.
- Kesselheim AS, Studdert DM, Mello MM. Whistle-blowers' experiences in fraud litigation against pharmaceutical companies. New England Journal of Medicine. 2010;362(19):1832-1839. doi:10.1056/NEJMsr0912039.
- van Dongen D, Guldenmund F, Grossmann I, Groeneweg J. Classification of influencing factors of speaking-up behaviour in hospitals: a systematic review. BMC Health Services Research. 2024;24:1657. doi:10.1186/s12913-024-12138-x.
- United States v. Regeneron Pharmaceuticals, Inc., 128 F.4th 324 (1st Cir. 2025). https://www.ca1.uscourts.gov/sites/ca1/files/opnfiles/23-2086P-01A.pdf
- United States ex rel. Greenfield v. Medco Health Solutions, Inc., 880 F.3d 89 (3d Cir. 2018). https://www2.ca3.uscourts.gov/opinarch/171152p.pdf
- United States ex rel. Flanagan v. Fresenius Medical Care Holdings, Inc., No. 23-1305 (1st Cir. June 27, 2025). https://www.ca1.uscourts.gov/sites/ca1/files/opnfiles/23-1305P-01A.pdf
- United States v. AseraCare Inc., 938 F.3d 1278 (11th Cir. 2019). https://media.ca11.uscourts.gov/opinions/pub/files/201613004.pdf
- United States ex rel. Druding v. Care Alternatives, 952 F.3d 89 (3d Cir. 2020), and 81 F.4th 361 (3d Cir. 2023). https://www2.ca3.uscourts.gov/opinarch/183298p.pdf
- Winter ex rel. United States v. Gardens Regional Hospital & Medical Center, Inc., 953 F.3d 1108 (9th Cir. 2020). https://cdn.ca9.uscourts.gov/datastore/opinions/2020/03/23/18-55020.pdf
- United States ex rel. Polukoff v. St. Mark's Hospital, 895 F.3d 730 (10th Cir. 2018). https://www.ca10.uscourts.gov/sites/ca10/files/opinions/010110019400.pdf
- United States ex rel. Omni Healthcare Inc. v. MD Spine Solutions LLC, No. 25-1110 (1st Cir. Dec. 1, 2025). https://www.ca1.uscourts.gov/sites/ca1/files/opnfiles/25-1110P-01A.pdf
- United States ex rel. Kyer v. Thomas Health System, Inc., No. 25-1507 (4th Cir. June 4, 2026). https://www.ca4.uscourts.gov/opinions/251507.P.pdf
