OIG Compliance Program for AI-Powered Billing Systems

The Office of Inspector General (OIG) of the Department of Health and Human Services has maintained for over two decades that an effective compliance program is a healthcare organization's best defense against fraud, waste, and abuse. The OIG's compliance program framework — built on seven essential elements — is not legally mandated for most providers, but it is the standard against which the DOJ and OIG evaluate an organization's good faith efforts to prevent billing errors. Organizations with effective compliance programs receive more favorable treatment in enforcement actions, and organizations without them face an implicit presumption that they were not serious about preventing fraud.

The introduction of AI-powered billing systems does not change the fundamental compliance program framework. It does, however, require that each of the seven elements be re-examined and updated to address risks that are specific to AI: automated decision-making that humans may not understand, systematic errors that propagate across thousands of claims before detection, and the potential for AI systems to perpetuate or amplify billing inaccuracies present in their training data.

This guide applies the OIG's seven elements of an effective compliance program to AI-powered billing systems, providing practical implementation guidance for each element.

The Seven Elements Applied to AI Billing

The OIG first articulated the seven elements of an effective compliance program in its 1998 Compliance Program Guidance for Hospitals (63 Fed. Reg. 8987). The elements have been refined through subsequent guidance documents for various provider types, OIG advisory opinions, and the OIG's General Compliance Program Guidance issued in November 2023 — the first comprehensive update in over two decades. The 2023 guidance explicitly acknowledges the role of technology in billing and the need for compliance programs to adapt to technological change.

Element 1: Written Policies and Procedures for AI Use

The OIG Standard

Every compliance program must include written policies and procedures that articulate the organization's commitment to compliance, describe expected conduct, and provide specific guidance for risk areas. For AI billing systems, this means developing policies that specifically address how AI is used in the billing process.

Implementation for AI Billing

AI Acceptable Use Policy: A written policy defining the approved uses of AI in the organization's billing workflow. This policy should specify:

• Which AI tools are approved for coding and billing functions
• What types of coding decisions the AI system is authorized to make or suggest
• Which code families, service types, or clinical scenarios require mandatory human review of AI suggestions
• Whether AI-generated codes may be submitted without human review for any claim category (the recommended answer is no)
• How AI system outputs are integrated into the billing workflow
• Who has authority to approve changes to AI system configuration

Coding Accuracy Standards: Written standards defining acceptable accuracy rates for AI-generated codes. These standards should specify:

• Minimum accuracy thresholds by code family (E/M codes, procedure codes, modifiers, diagnosis codes)
• How accuracy is measured (exact match, clinically equivalent match, over/under-coding rate)
• What happens when accuracy falls below thresholds (system suspension, enhanced review, vendor notification)
• Frequency of accuracy measurement (monthly, quarterly, per model update)

AI Error Response Protocol: A documented procedure for responding to identified AI coding errors, including:

• Escalation pathway from error identification to compliance investigation
• Criteria for determining whether errors are isolated or systematic
• Timeline for corrective action, including claim resubmission and overpayment return
• Documentation requirements at each step of the error response process
• When to engage legal counsel (recommended: when systematic errors are identified that may trigger the 60-day overpayment rule)

AI Vendor Management Policy: Written procedures for evaluating, onboarding, and monitoring AI billing vendors, including:

• Due diligence requirements before vendor selection (accuracy validation, reference checks, compliance certifications)
• Contract requirements (accuracy warranties, error notification obligations, audit rights)
• Ongoing vendor oversight responsibilities
• Procedures for vendor termination if compliance standards are not met

Documentation and Accessibility

Written policies must be documented in a format accessible to all relevant staff. They should be reviewed and updated at least annually, and whenever the AI system is materially changed (new model version, new code families added, new clinical specialties covered). Version history should be maintained to demonstrate the evolution of the compliance program over time.

Element 2: Compliance Officer Oversight of AI Systems

The OIG Standard

An effective compliance program requires a designated compliance officer with sufficient authority, resources, and access to senior leadership to implement the compliance program effectively. The compliance officer must have direct access to the organization's governing body.

Implementation for AI Billing

Compliance officer authority over AI systems: The compliance officer must have the authority to:

• Review and approve the deployment of new AI billing tools before go-live
• Order suspension of AI billing functions if compliance concerns are identified
• Access AI system performance data, including accuracy metrics and error logs
• Direct internal audits of AI-generated billing
• Escalate AI compliance concerns directly to the board or governing body

AI expertise requirements: The compliance officer does not need to be a machine learning engineer, but must have sufficient understanding of AI billing systems to:

• Interpret accuracy metrics and audit results
• Understand the difference between AI model updates, configuration changes, and workflow modifications
• Evaluate vendor representations about AI system capabilities and limitations
• Identify when external expertise is needed for AI compliance assessments

Compliance committee participation: If the organization has a compliance committee, at least one member should have operational knowledge of the AI billing system. This could be the billing department manager, the IT director responsible for the AI platform, or an external consultant with AI healthcare billing expertise.

Reporting structure: The compliance officer's reporting on AI billing should be included in regular compliance reports to the governing body. Reports should include AI system accuracy metrics, audit results, identified errors and corrective actions, and any pending compliance concerns.

Element 3: Training on AI-Assisted Billing

The OIG Standard

All employees who are affected by the compliance program must receive appropriate training. Training must be specific to the employee's role and responsibilities, and it must be updated as compliance risks evolve.

Implementation for AI Billing

Coding staff training: Medical coders who interact with AI coding suggestions require training on:

• How the AI system generates code suggestions (conceptual understanding, not technical detail)
• Known limitations and error patterns of the AI system
• The coder's responsibility to independently evaluate AI suggestions against clinical documentation
• How to override AI suggestions and document the rationale for overrides
• Red flags that suggest the AI system may be generating inaccurate codes (e.g., codes inconsistent with the provider's specialty, codes not supported by documentation)
• How to report AI coding concerns through the compliance program

Billing staff training: Billing personnel who process AI-generated claims require training on:

• Their role in the claim submission workflow and their responsibility for claim accuracy
• How to identify claims that have been AI-generated versus manually coded
• When to escalate billing concerns about AI-generated claims
• The organization's policy on submitting AI-generated claims (which claims require human review, which code categories require additional scrutiny)

Provider training: Physicians and other providers whose documentation is processed by AI coding systems require training on:

• How AI coding systems use their documentation to generate codes
• The importance of complete and specific documentation for accurate AI coding
• How to review AI-suggested codes for their encounters (if providers are part of the review workflow)
• Their legal responsibility for the accuracy of claims submitted under their provider numbers

Compliance staff training: Compliance team members require training on:

• AI-specific compliance risks (systematic errors, training data bias, model drift)
• How to interpret AI accuracy metrics and audit results
• Current regulatory guidance on AI in healthcare billing (OIG, DOJ, CMS)
• How to conduct compliance audits of AI-generated billing

Training frequency and documentation: Training should occur at onboarding, when the AI system is first deployed, when material changes are made to the AI system, and at least annually thereafter. All training must be documented, including attendance records, training content, and assessment results (if applicable).

Element 4: Internal Monitoring and Auditing of AI Coding Output

The OIG Standard

The OIG considers internal monitoring and auditing to be "perhaps the most critical" compliance activity. Monitoring is ongoing review of compliance indicators, while auditing is periodic, focused examination of specific risk areas. Both are essential for AI billing systems.

Implementation for AI Billing

Continuous monitoring metrics: Establish a dashboard of AI billing metrics that are reviewed at defined intervals (daily, weekly, or monthly, depending on claim volume):

• Code distribution analysis: Compare the distribution of codes assigned by the AI system against pre-AI baselines and peer benchmarks. Shifts toward higher-complexity codes (upcoding) or increased use of specific modifiers are red flags.
• Override rate: Track how frequently human reviewers override AI suggestions. A high override rate may indicate poor AI accuracy. A very low override rate may indicate insufficient human review (rubber-stamping).
• Error rate by category: Track identified errors by code family, clinical specialty, payer, and error type (overcoding, undercoding, incorrect modifier, wrong diagnosis).
• Denial rate for AI-generated claims: Compare denial rates for AI-generated claims against historically coded claims. Increased denials may indicate coding accuracy issues.
• Revenue per encounter trends: Monitor average revenue per encounter by provider and specialty. Unexplained increases after AI deployment may indicate upcoding.

Periodic auditing program: Conduct formal coding audits at defined intervals:

• Pre-deployment audit: Before the AI system goes live, audit a sample of at least 100 claims (more for organizations with diverse specialties) comparing AI-generated codes against codes assigned by certified coding professionals. This establishes a baseline accuracy rate.
• Post-deployment audits: Monthly for the first six months after deployment, quarterly thereafter. Audit a random sample of AI-generated claims, with the sample size determined by statistical significance requirements (typically 30-50 claims per specialty per audit period).
• Targeted audits: Conduct focused audits when monitoring metrics identify potential issues — for example, if the code distribution shifts or if a specific code family shows elevated error rates.
• Post-update audits: Whenever the AI model is updated, conduct an audit within 30 days of the update to verify that accuracy has been maintained.

Audit methodology: Audits should be conducted by individuals who are independent of the billing operation — ideally credentialed coding professionals (CPC, CCS, or equivalent) who were not involved in the AI system's deployment or daily operation. External auditors should be engaged periodically to validate internal audit results.

Audit documentation: All audit results must be documented, including:

• Audit scope and methodology
• Sample selection criteria
• Findings by code family and error type
• Overall accuracy rate
• Comparison to previous audit periods
• Recommended corrective actions
• Management response to recommendations

Element 5: Reporting Mechanisms for AI Errors

The OIG Standard

An effective compliance program must include a reporting mechanism — such as a hotline or other channel — that allows employees to report compliance concerns without fear of retaliation. The reporting mechanism must be accessible, confidential, and responsive.

Implementation for AI Billing

Reporting channels: Employees who identify AI coding errors or concerns must have clear channels for reporting, including:

• Direct reporting to the compliance officer or compliance department
• An anonymous compliance hotline or web-based reporting portal
• Reporting through the employee's supervisor (with an alternative path if the supervisor is part of the concern)
• Documentation of the reporting process in the AI billing policy

What to report: Training should clarify the types of AI-related issues that should be reported through compliance channels:

• Patterns of AI-generated codes that appear inconsistent with clinical documentation
• AI system behavior that changes unexpectedly (different coding patterns after an update)
• Pressure from management to approve AI-generated codes without adequate review
• Vendor communications suggesting that human review is unnecessary
• Discovery of past claims that were submitted with AI coding errors
• Concerns about AI system access to patient data beyond what is necessary

Non-retaliation protections: The organization's non-retaliation policy must explicitly cover reports about AI system compliance concerns. Given the qui tam provisions of the False Claims Act, employees who report AI billing concerns internally and feel their concerns are not adequately addressed have a powerful external avenue — filing a qui tam complaint. Robust internal reporting mechanisms that are taken seriously reduce this risk.

Response requirements: Every report received through the compliance reporting mechanism must be logged, evaluated, investigated if warranted, and resolved with documented corrective action (or documented rationale for why no corrective action was needed). Response timelines should be established in the compliance program policies — for example, initial acknowledgment within 48 hours, investigation within 30 days, and resolution within 60 days.

Element 6: Enforcement Through Disciplinary Standards

The OIG Standard

Compliance programs must include well-publicized disciplinary standards for violations. The OIG expects that compliance violations result in consistent disciplinary action, regardless of the employee's position or tenure.

Implementation for AI Billing

Disciplinary standards for AI-related compliance violations:

• Failure to review AI-generated codes: If a coder is assigned to review AI coding suggestions and approves them without performing a genuine review, this is a compliance violation subject to disciplinary action.
• Overriding compliance controls: If an employee bypasses established AI review workflows — for example, submitting AI-generated claims directly without the required human review step — this is a compliance violation.
• Failure to report known errors: If an employee identifies AI coding errors and fails to report them through established channels, this constitutes a compliance violation.
• Retaliation: Any retaliation against an employee who reports AI compliance concerns through established channels must result in disciplinary action against the retaliating individual.
• Management failure: Supervisors and managers who pressure staff to approve AI-generated codes without adequate review, who fail to act on reported AI compliance concerns, or who fail to implement recommended corrective actions face disciplinary consequences.

Consistency: Disciplinary standards must be applied consistently. An organization that disciplines a junior coder for failing to review AI codes but does not discipline a department director for overriding compliance recommendations about the AI system has a fundamentally compromised compliance program.

Vendor accountability: While the organization cannot impose disciplinary standards on vendor employees, the vendor contract should include performance standards, error reporting obligations, and termination provisions that create accountability for AI system accuracy.

Element 7: Prompt Corrective Action

The OIG Standard

When compliance violations are identified, the organization must take prompt corrective action to address the violation, prevent recurrence, and remedy any harm caused. For AI billing systems, "prompt corrective action" has specific operational implications.

Implementation for AI Billing

Immediate response protocol: When a systematic AI coding error is identified:

1. Assess scope: Determine whether the error is isolated (a single claim or small number of claims) or systematic (affecting a class of claims over a defined period).
2. Contain the error: For systematic errors, immediately implement enhanced human review or suspend the AI system for the affected code category until the error is corrected.
3. Quantify impact: Identify all claims affected by the error, quantify the financial impact, and determine whether overpayments or underpayments resulted.
4. Correct the AI system: Work with the vendor to identify the root cause of the error and implement corrections. Do not resume full AI-assisted billing until the correction is validated through testing.
5. Remediate claims: Resubmit corrected claims for underpayments. For overpayments, initiate the refund process in compliance with the 60-day overpayment rule (42 U.S.C. 1320a-7k(d)).
6. Report if required: If the error involves a systematic pattern of overpayments to Medicare or Medicaid, consider whether the OIG Self-Disclosure Protocol or CMS Voluntary Self-Referral Disclosure Protocol is appropriate.
7. Document everything: Maintain a complete record of the error identification, investigation, corrective action, and remediation.

Root cause analysis: For systematic AI errors, conduct a root cause analysis to understand why the error occurred and why existing monitoring did not catch it sooner. Update monitoring metrics, audit procedures, and training materials based on the root cause analysis findings.

Preventive measures: Corrective action should include measures to prevent similar errors in the future. This may include:

• Enhanced monitoring for the code category or clinical scenario where the error occurred
• Additional validation testing before future AI model updates
• Updated training for coding staff on the specific error pattern
• Revised AI system configuration or constraints
• New or modified compliance policies addressing the identified risk

OIG Work Plan Priorities Related to AI

The OIG's annual Work Plan identifies focus areas for audits, evaluations, and investigations. AI-related billing practices have appeared in the Work Plan with increasing frequency. Key areas of OIG focus include:

E/M Coding Accuracy

The OIG has historically focused on E/M coding accuracy as a high-risk area. The introduction of AI coding tools adds a new dimension: are AI systems coding E/M visits more or less accurately than human coders? Are AI systems systematically upcoding E/M visits? The OIG's data analytics capabilities allow it to identify providers whose E/M coding distributions shifted after AI deployment — making this a readily targetable audit area.

Modifier Usage

Modifier 25 (significant, separately identifiable E/M service) and modifier 59 (distinct procedural service) are perennial OIG targets. AI systems trained on historical billing data that included excessive modifier usage will perpetuate those patterns. The OIG monitors modifier usage rates against peer benchmarks, and providers using AI systems should do the same.

Telehealth Billing

Post-pandemic telehealth billing remains an OIG priority. AI systems that process telehealth claims must correctly apply place of service codes, modifiers, and the complex web of federal and state telehealth billing rules. Errors in telehealth billing are a growing area of OIG scrutiny.

Clinical Lab and Diagnostic Coding

AI-assisted coding for laboratory and diagnostic services — including the appropriate use of diagnosis codes to establish medical necessity — is an area where the OIG has identified significant overpayment risk. AI systems that assign diagnosis codes to support medical necessity for ordered tests must be validated against actual clinical documentation.

Audit Triggers for AI-Billed Claims

Understanding what triggers an external audit allows organizations to focus their internal monitoring efforts. Common audit triggers for AI-billed claims include:

Statistical outliers: Billing patterns that deviate significantly from peer norms — particularly shifts in code distribution that coincide with AI system deployment. If a practice's E/M coding distribution shifts from 30% level 4/5 to 50% level 4/5 within three months of deploying an AI coding system, this pattern will be visible to payer and government auditors.

Rapid revenue increases: Unexplained increases in average revenue per encounter or total billing volume that coincide with technology changes. Auditors correlate technology deployment timelines with billing pattern changes.

High modifier usage: Modifier usage rates that exceed peer benchmarks, particularly for modifiers 25 and 59. AI systems that overuse modifiers create audit targets.

Denial pattern changes: Significant changes in denial rates — either increases (suggesting coding accuracy issues) or decreases (which may suggest the AI is coding more aggressively and payers have not yet caught up with audit activity).

Whistleblower complaints: Qui tam complaints from current or former employees remain one of the most common audit triggers. As discussed in Element 5, robust internal reporting mechanisms reduce this risk.

OIG Self-Disclosure Protocol

When an organization identifies systematic AI billing errors that resulted in overpayments to federal healthcare programs, the OIG Self-Disclosure Protocol (SDP) provides a mechanism for voluntary disclosure. The SDP, established under 63 Fed. Reg. 58399 and updated periodically, allows providers to report potential fraud to the OIG and negotiate a resolution.

When to Consider Self-Disclosure

Self-disclosure is appropriate when:

• The organization has identified a systematic pattern of overpayments resulting from AI coding errors
• The overpayments involve federal healthcare programs (Medicare, Medicaid)
• The errors may rise to the level of FCA liability (beyond simple billing mistakes)
• The organization wants to demonstrate good faith and potentially negotiate reduced penalties

Benefits of Self-Disclosure

• The OIG generally resolves SDP cases with minimum damages (1.5x the overpayment amount, compared to treble damages under the FCA)
• Self-disclosure demonstrates good faith, which may reduce the risk of OIG exclusion
• Resolution through the SDP is typically faster and less costly than contested litigation
• Self-disclosure may satisfy the organization's obligations under the 60-day overpayment rule

Considerations Before Self-Disclosure

Self-disclosure should be made in consultation with legal counsel experienced in healthcare fraud and compliance. Key considerations include:

• Whether the identified errors actually constitute potential FCA liability (not all billing errors are false claims)
• The financial exposure under various resolution scenarios
• Whether the organization can quantify the overpayments with reasonable precision
• Whether concurrent corrective action has been implemented
• Whether any employees may have individual liability exposure

Building a Compliance Program for the AI Era

The seven elements of an effective compliance program are not new. What is new is the application of these elements to AI systems that make — or substantially influence — thousands of billing decisions daily. The organizations that successfully integrate AI into their billing operations while maintaining compliance will share several characteristics:

They treat AI as a tool, not an authority. AI-generated codes are suggestions to be evaluated, not directives to be followed. The human coder remains the decision-maker, and the compliance program reflects this.

They measure what matters. They monitor AI accuracy with the same rigor they apply to human coding accuracy — and they act on the results. Accuracy metrics are not marketing numbers; they are compliance indicators.

They build feedback loops. When errors are identified, the information flows back to improve the AI system, update training materials, refine monitoring metrics, and strengthen policies. Compliance is iterative, not static.

They document proactively. They do not wait for an audit to create documentation. They build documentation into the workflow so that every AI-assisted billing decision has a documented trail from clinical documentation to code suggestion to human review to claim submission.

They engage leadership. The governing body receives regular reports on AI billing compliance. Leadership understands the risks, supports the compliance program with adequate resources, and takes action when issues are identified.

The OIG's compliance program framework has proven remarkably durable across decades of technological change. AI is the latest — and perhaps the most consequential — technology to test that framework. Organizations that apply the seven elements with discipline and specificity will find that AI-powered billing and regulatory compliance are not in tension. They are complementary.