AI Medical Billing and the False Claims Act: What You Need t...

The False Claims Act (31 U.S.C. 3729-3733) is the federal government's primary tool for combating fraud against government healthcare programs. In fiscal year 2024, the Department of Justice recovered over $2.9 billion under the FCA, with healthcare fraud accounting for the largest share of recoveries. As AI systems assume a growing role in medical coding and billing, the intersection of the FCA and AI-generated claims creates a new category of legal risk that every healthcare organization must understand.

This is not theoretical risk. The DOJ has publicly stated that it is closely monitoring AI in healthcare billing. The OIG has added AI-related billing practices to its Work Plan. And the FCA's "knowing" standard — which encompasses reckless disregard and deliberate ignorance — maps uncomfortably well onto organizations that deploy AI billing systems without adequate oversight.

This guide covers the FCA as it applies to AI-assisted medical billing: the statutory framework, the liability standards, the enforcement landscape, and the compliance practices that separate organizations taking reasonable precautions from those assuming unreasonable risk.

False Claims Act Fundamentals

The Statute

The False Claims Act (31 U.S.C. 3729) imposes liability on any person who "knowingly" submits or causes to be submitted a "false or fraudulent claim" for payment to the federal government. In healthcare, this means any inaccurate claim submitted to Medicare, Medicaid, TRICARE, or other federal healthcare programs.

The key operative provisions are:

31 U.S.C. 3729(a)(1)(A): Liability for knowingly presenting, or causing to be presented, a false or fraudulent claim for payment or approval.

31 U.S.C. 3729(a)(1)(B): Liability for knowingly making, using, or causing to be made or used, a false record or statement material to a false or fraudulent claim.

31 U.S.C. 3729(a)(1)(G): Liability for knowingly making, using, or causing to be made or used, a false record or statement material to an obligation to pay or transmit money or property to the Government — the "reverse false claim" provision, which applies to organizations that discover overpayments and fail to return them.

Penalties

FCA penalties are severe and designed to be punitive. As of 2026, penalties include:

Treble damages: Three times the amount of the false claim
Per-claim penalties: Civil penalties between $13,946 and $27,894 per false claim (adjusted annually for inflation)
Exclusion: While not an FCA penalty directly, FCA violations commonly lead to exclusion from federal healthcare programs under the OIG's permissive exclusion authority

For an organization that submits thousands of AI-generated claims monthly, the per-claim penalty structure creates exposure that can reach hundreds of millions of dollars even when the individual claim amounts are modest.

The "Knowing" Standard and AI

The FCA's liability threshold is not intent to defraud. It is "knowing" submission of a false claim. Under 31 U.S.C. 3729(b)(1), "knowing" is defined to include:

Actual knowledge: The person knew the claim was false
Deliberate ignorance: The person deliberately ignored information indicating the claim was false
Reckless disregard: The person acted with reckless disregard as to the truth or falsity of the claim

The statute explicitly provides that "no proof of specific intent to defraud is required." This is the provision that creates the most significant risk for organizations using AI in billing.

How the "Knowing" Standard Applies to AI Billing

Reckless disregard scenario: An organization deploys an AI coding system without validating its accuracy against established coding guidelines. The AI consistently upcodes E/M visits, assigning 99215 when documentation supports 99214. The organization submits the AI-generated codes without human review. Even though no individual at the organization intentionally submitted false claims, the failure to validate the AI's coding accuracy and the absence of human oversight could constitute reckless disregard.

Deliberate ignorance scenario: An organization's internal audit identifies that its AI coding system has a 15% error rate for modifier usage, resulting in systematic overpayment. The organization continues using the system without correcting the errors because the overpayments benefit revenue. This is deliberate ignorance of the false claims being generated.

Actual knowledge scenario: A billing manager reviews AI-suggested codes and recognizes that the AI is assigning codes for services not documented in the medical record. The manager approves the claims anyway because reversing the AI's suggestions would require additional work. This is actual knowledge.

The Escobar Implied Certification Theory

In Universal Health Services v. United States ex rel. Escobar (579 U.S. 176, 2016), the Supreme Court held that the FCA's "implied false certification" theory can be a basis for liability. Under this theory, when a provider submits a claim, it implicitly certifies compliance with all material conditions of payment — including accurate coding.

Applied to AI billing: when an organization submits a claim generated or suggested by an AI system, it implicitly certifies that the claim is accurate and compliant with all applicable coding rules, documentation requirements, and program conditions. If the AI system generates inaccurate codes and the organization submits them, the organization has made an implied false certification — regardless of whether any human reviewed the code.

The materiality requirement established in Escobar (the falsehood must be material to the government's payment decision) is almost always met in coding cases. Accurate coding is a fundamental condition of payment for Medicare and Medicaid claims.

Qui Tam Whistleblower Implications

The FCA's qui tam provisions (31 U.S.C. 3730) allow private individuals — known as "relators" — to file lawsuits on behalf of the federal government and share in any recovery. Relators receive between 15% and 30% of the recovery, creating powerful financial incentives for whistleblowers.

Who Blows the Whistle on AI Billing?

The individuals most likely to identify AI billing irregularities and file qui tam actions include:

Coders and billing staff: Experienced medical coders who are asked to approve AI-generated codes they believe are inaccurate. If they raise concerns internally and are ignored, they have both the knowledge and the motivation to file a qui tam complaint.

Compliance officers: Compliance professionals who identify AI coding accuracy issues through audits and whose recommended corrective actions are not implemented by management.

IT staff and data analysts: Technical staff who have visibility into AI system performance metrics and can identify patterns of overcoding or inaccurate code assignment.

Former employees: Staff who leave the organization and subsequently file qui tam complaints based on knowledge gained during their employment.

Protecting Against Qui Tam Risk

The single most important protection against qui tam actions is a robust internal compliance program that takes reported concerns seriously and implements corrective action. Organizations that investigate and address AI coding issues when they are identified internally reduce both their legal exposure and the motivation for employees to file external complaints.

The FCA includes a "public disclosure bar" (31 U.S.C. 3730(e)(4)) that limits qui tam actions based on publicly disclosed information, but this bar is narrow and does not protect against actions based on information known internally but not publicly disclosed.

DOJ Enforcement Trends

The DOJ Civil Cyber-Fraud Initiative and AI

Launched in 2021, the DOJ's Civil Cyber-Fraud Initiative uses the FCA to pursue government contractors and grant recipients that fail to meet cybersecurity requirements. While initially focused on cybersecurity, the initiative's framework for holding technology-dependent organizations accountable for system failures applies directly to AI billing systems. The DOJ has signaled that AI systems that generate false claims due to inadequate validation or oversight may be pursued under similar theories.

Enforcement Priorities

The DOJ's enforcement priorities related to AI in healthcare billing include:

Upcoding: AI systems that systematically assign higher-level codes than documentation supports. This is the most straightforward FCA theory and the area where AI creates the most measurable risk.

Unbundling and rebundling: AI systems that improperly separate bundled services or inappropriately bundle services to maximize reimbursement.

Medical necessity: AI systems that generate claims for services that are not medically necessary based on the clinical documentation. If an AI system suggests billing for services the clinical record does not support, and those claims are submitted, FCA liability attaches.

Modifier misuse: AI systems that inappropriately apply modifiers (such as modifier 25 or modifier 59) to increase reimbursement. Modifier usage is a frequent audit target, and AI systems trained on historical billing data that included modifier overuse will perpetuate those patterns.

Composite Enforcement Example

Consider this scenario, adapted from multiple real enforcement actions: A large multi-specialty practice deploys an AI coding system across all departments. Over 18 months, the AI system assigns E/M level 5 codes (99215) at a rate 40% higher than the practice's pre-AI coding patterns and 35% higher than peer benchmarks. The practice's compliance department identifies the trend in an internal audit but does not halt the AI system or conduct a claim-by-claim review. A coder who raised concerns about the AI's accuracy is told to approve the AI suggestions to maintain productivity targets. The coder files a qui tam complaint.

The DOJ investigation reveals that the AI system was trained on coding data from a single high-acuity subspecialty and was applied across primary care and other specialties without recalibration. The practice submitted over 50,000 upcoded claims to Medicare over the 18-month period. Under the FCA, the practice faces treble damages on the overpayment amount plus per-claim penalties on each of the 50,000 claims. Total exposure exceeds $100 million.

This scenario illustrates the convergence of the "knowing" standard (reckless disregard in deploying an uncalibrated AI system), qui tam provisions (the coder who was ignored), and the implied certification theory (every submitted claim implicitly certified accurate coding).

OIG Guidance on AI in Billing

OIG Work Plan

The Office of Inspector General includes AI-related billing practices in its annual Work Plan, which identifies areas of focus for audits, investigations, and enforcement. Recent Work Plan priorities related to AI include:

Evaluation and Management coding accuracy for AI-assisted claims
Modifier usage patterns in practices using AI coding tools
Medical necessity determinations supported by AI clinical decision support
Compliance program adequacy for organizations deploying AI billing systems

OIG Compliance Program Guidance

The OIG's seven elements of an effective compliance program (detailed in a companion article) apply with particular force to AI billing systems. The OIG has indicated that compliance programs that do not specifically address AI systems may be considered inadequate — particularly the monitoring and auditing element, which requires organizations to affirmatively verify the accuracy of AI-generated billing.

OIG Advisory Opinions

While the OIG has not yet issued an advisory opinion specifically addressing AI in billing, the principles from existing advisory opinions on billing accuracy, medical necessity, and compliance program adequacy apply directly. Organizations can request advisory opinions on specific AI billing arrangements, though the process is time-consuming and fact-specific.

Provider vs. Vendor Liability

Provider Liability

The provider that submits the claim bears primary FCA liability. This is true regardless of whether the claim was generated, suggested, or auto-populated by an AI system. The provider is the entity that submits or causes the submission of the claim to the federal government, and the provider is the entity that implicitly certifies the claim's accuracy.

Providers cannot delegate FCA liability to AI vendors through contract provisions. A contract clause stating that the vendor is "responsible for coding accuracy" does not eliminate the provider's FCA exposure. The government will pursue the entity that submitted the false claim.

Vendor Liability

AI vendors can also face FCA liability under the "causing to be submitted" language of 31 U.S.C. 3729(a)(1)(A). If a vendor knows its AI system generates inaccurate codes and provides the system to healthcare organizations without adequate disclosure of its limitations, the vendor may have "caused" the submission of false claims.

Additionally, vendors face potential liability under 31 U.S.C. 3729(a)(1)(B) if they make false statements about their system's accuracy (for example, in marketing materials or implementation documentation) that are material to providers' decisions to submit AI-generated claims.

Contractual Risk Allocation

While FCA liability cannot be contractually eliminated, the vendor contract should address:

Accuracy representations and warranties: What accuracy standards does the vendor commit to, and how are they measured?
Indemnification: Does the vendor indemnify the provider for losses resulting from AI coding errors?
Validation requirements: Does the contract require the provider to validate AI outputs, and does the vendor provide tools for validation?
Error reporting: How quickly must the vendor disclose discovered coding inaccuracies?

Documentation Requirements for AI-Assisted Coding

Adequate documentation is the primary defense against FCA liability. Organizations using AI for coding and billing should maintain:

AI System Documentation

Validation studies: Results of accuracy testing conducted before and after deployment, including accuracy rates by code family, specialty, and payer
Configuration records: Documentation of how the AI system was configured, calibrated, and customized for the organization
Update logs: Records of all AI model updates, including pre- and post-update accuracy testing
Known limitations: Documented limitations of the AI system, including code categories or specialties where accuracy is lower

Operational Documentation

Human review records: Evidence that AI-suggested codes were reviewed by qualified coding professionals before claim submission
Override documentation: When human reviewers override AI suggestions, documentation of why the change was made
Audit results: Internal audit findings, including accuracy rates, error patterns, and corrective actions taken
Training records: Evidence that coding staff were trained on how to evaluate and validate AI-generated codes

Compliance Documentation

Compliance program updates: Evidence that the compliance program was updated to address AI-specific risks
Risk assessments: Documented risk assessments specific to AI billing systems
Corrective action records: When AI errors are identified, documentation of the corrective action taken, including claim resubmission or refund where appropriate

Best Practices for FCA Compliance with AI Billing

1. Never Submit AI-Generated Codes Without Human Review

This is the single most important practice. AI coding suggestions should be treated as decision support, not decision replacement. Qualified medical coders should review AI-generated codes against clinical documentation before claims are submitted. The level of review may vary based on risk — high-dollar claims and complex E/M coding warrant more intensive review than straightforward procedure codes — but no claim should be submitted based solely on AI output without any human verification.

2. Validate AI Accuracy Before Deployment

Before deploying an AI coding system, conduct a validation study using a representative sample of claims. Compare AI-generated codes against codes assigned by experienced, credentialed coders. Document the results by code family, specialty, and complexity level. Establish minimum accuracy thresholds and do not deploy the system until those thresholds are met.

3. Monitor AI Accuracy Continuously

Accuracy validation is not a one-time event. Conduct ongoing audits comparing AI-generated codes to human-reviewed codes. Track accuracy rates over time and investigate any declining trends. Monitor for systematic patterns such as upcoding, unbundling, or modifier overuse.

4. Respond to Identified Errors Promptly

When AI coding errors are identified — whether through internal audits, payer audits, or employee reports — take prompt corrective action. This includes correcting the AI system configuration, resubmitting corrected claims, and returning overpayments. Under the 60-day rule (42 U.S.C. 1320a-7k(d)), providers must report and return identified Medicare and Medicaid overpayments within 60 days of identification. Failure to return identified overpayments converts them into "reverse false claims" under 31 U.S.C. 3729(a)(1)(G).

5. Maintain Robust Compliance Program

Ensure your compliance program specifically addresses AI billing risks. This means updating written policies, training staff, designating compliance oversight of AI systems, establishing reporting mechanisms for AI-related concerns, and conducting regular audits. The OIG's seven elements of an effective compliance program are the minimum standard.

6. Document Everything

Maintain comprehensive documentation of AI system selection, validation, deployment, monitoring, and error correction. This documentation serves two purposes: it demonstrates good faith compliance efforts if FCA liability is alleged, and it provides the evidentiary foundation for defending against qui tam and government enforcement actions.

7. Engage Legal Counsel

Healthcare organizations deploying AI billing systems should engage legal counsel with FCA and healthcare compliance expertise. Legal counsel should review the AI vendor contract, participate in compliance program development, and provide guidance on responding to identified errors. Attorney-client privilege protects compliance program communications, which is critical if compliance investigations later become relevant to FCA litigation.

The 60-Day Overpayment Rule and AI

The Affordable Care Act established a 60-day deadline for reporting and returning identified overpayments to Medicare and Medicaid (42 U.S.C. 1320a-7k(d), implemented through 42 CFR 401.305). Under the FCA's reverse false claim provision, retention of an identified overpayment beyond 60 days constitutes a false claim.

This rule creates a specific challenge for AI billing systems. If an internal audit reveals that the AI system has been systematically upcoding, the organization must quantify the overpayments and return them within 60 days of identification. For large organizations processing thousands of AI-generated claims, the quantification process alone can consume most of the 60-day window.

Best practice: when AI coding errors are identified, immediately engage the compliance and legal teams, begin quantification, and consider whether interim measures (such as suspending the AI system or implementing mandatory human review for the affected code categories) are necessary while quantification is underway. If 60 days is insufficient to complete quantification, the organization should report the issue to CMS and document good-faith efforts to quantify and return the overpayment.

Conclusion

The False Claims Act is a powerful and flexible statute that applies with full force to AI-generated medical billing. The "knowing" standard — particularly the reckless disregard and deliberate ignorance prongs — means that organizations cannot deploy AI billing systems blindly and then claim ignorance when errors are discovered. The qui tam provisions ensure that internal knowledge of AI coding problems creates legal risk even if the organization's leadership chooses not to address them.

The path to FCA compliance with AI billing is not complicated, but it requires discipline: validate before deployment, review before submission, monitor continuously, correct promptly, and document everything. Organizations that follow these practices can realize the efficiency benefits of AI billing while managing FCA risk to acceptable levels. Organizations that treat AI as a "set and forget" billing automation tool are building FCA exposure with every claim they submit.