Medical billing compliance means every claim you send matches the care documented, uses current codes, follows the payer's rules, and is handled in a way that protects patient data. In practice it is a set of checks run on a schedule. Work through the ten areas below once to find the gaps, then put each check on a calendar (the table at the end says when). Most problems aren't dramatic: an old code in a template, a modifier added out of habit, a fee schedule nobody updated.
1. Update to the Current CPT and ICD-10-CM Code Sets
Code sets change on fixed dates. CPT and HCPCS update each January. The FY 2026 ICD-10-CM code set and guidelines covered October 1, 2025 through September 30, 2026; the FY 2027 update took effect on October 1, 2026, so services from that date on must be coded with the new set.
Check:
- Your practice management system and EHR have the FY 2027 ICD-10-CM files loaded.
- Deleted codes are gone from templates, favorites lists and superbills, not just from the code tables.
- Your coders have been briefed on the new and revised codes in your specialty.
- Claims with dates of service from October 1, 2026 use the new set.
2. Align E/M Coding With Medical Decision-Making Standards
Office and outpatient E/M levels are chosen by medical decision making or by total time on the date of the visit. E/M is a frequent audit focus.
Check:
- For example, each quarter, pull a handful of E/M visits per provider and compare the level billed with what the note supports.
- Time-based visits record the total time.
- Notes aren't copied forward or templated so heavily that every visit reads the same.
3. Verify Eligibility, Authorization, and Referral Data Before the Claim Exists
A missing prior authorization, an expired referral or an unsupported diagnosis can stop payment even when the coding is right. Rules are tightening on the payer side too: since January 1, 2026, Medicare Advantage plans and Medicaid and CHIP programs must decide prior authorization requests within 72 hours for urgent requests and seven calendar days for standard ones, and must offer a Prior Authorization API from January 1, 2027 (CMS).
Check:
- Eligibility is verified before every visit, not only the first.
- The authorization number is on file before the service, and visit counts and date ranges are tracked.
- The front desk, clinical staff and billing can all see authorization status in one place.
4. Strengthen HIPAA Security and Breach Response Protocols
Hacking is the leading cause of large healthcare data breaches reported to HHS, and phishing and stolen credentials are a common way in. A proposed update to the Security Rule (January 2025) would make encryption and multi-factor authentication required; it is not final.
Check:
- You have a current, written security risk analysis, which the Security Rule requires, reviewed when systems change.
- Every user has their own login, access matches the job, and accounts are closed the day someone leaves.
- Patient data is encrypted in transit and at rest, and billing systems and email use multi-factor authentication.
- Every vendor that handles patient data (clearinghouse, billing company, IT support) has a signed business associate agreement.
- Your breach plan reflects the notification rules: affected patients within 60 calendar days of discovery; HHS at the same time for 500 or more people, or within 60 days of the year's end for fewer.
5. Apply NCCI Edits and Modifier Rules Correctly
The National Correct Coding Initiative (NCCI) sets which codes can't be billed together and how many units are allowed, and CMS updates its edits quarterly.
Check:
- Your claim scrubber loads each quarter's NCCI edits.
- Modifiers 25 and 59 are added only where the note shows a separate service, never as a default to get past an edit.
- How often each provider uses those modifiers is reviewed, and a high rate is looked into.
6. Incorporate New HCPCS Level II Codes
HCPCS Level II has an annual update plus quarterly updates, with new codes, revised descriptors and payment changes for supplies, DME, drugs and other services that CPT doesn't cover.
Check:
- The current quarter's HCPCS Alpha-Numeric file is in your system.
- If you bill DME, supplies or injectables, someone reviews each quarter's changes for your codes.
7. Reconcile Fee Schedules and Conversion Factor Changes
Each year's Physician Fee Schedule changes what Medicare pays. For 2026, CMS set two conversion factors, $33.57 for qualifying APM participants and $33.40 for everyone else (CMS). If the expected amounts in your system aren't updated, underpayments go unnoticed, because every payment looks normal.
Check:
- Each payer's current fee schedule is loaded as the expected payment.
- Your highest-volume codes are compared, paid against expected, early in the year.
8. Monitor Denial Patterns and Conduct Structured Audits
The OIG's compliance guidance counts auditing and monitoring as a basic part of a compliance program.
Check:
- Denials are tracked by reason each month, and repeat reasons are traced to a cause.
- High-risk codes and new services get a scheduled internal audit.
- A sample of claims is tested after any system or code-set change, before the full batch goes out.
- Overpayments found are reported and returned: for Medicare and Medicaid, within 60 days of identifying them, with up to 180 days allowed for a timely, good-faith investigation.
9. Support Telehealth and Remote Monitoring Billing With Proper Documentation
Telehealth, Remote Patient Monitoring (RPM) and Remote Therapeutic Monitoring (RTM) need documentation of how, how long and why the service was provided. Medicare's telehealth flexibilities are temporary and have been extended several times, so check the end date on CMS's telehealth page before each new year.
Check:
- The place of service matches where the patient was: POS 10 for telehealth in the patient's home, POS 02 elsewhere.
- Consent is recorded for monitoring services, and time logs support the codes billed.
10. Keep Staff Training Current and Documented
Compliance depends on the people doing the work.
Check:
- Training on coding updates, HIPAA and documentation is scheduled through the year, not only at onboarding.
- You keep a record of who was trained, when and on what.
- New hires and current staff are checked against the OIG's List of Excluded Individuals/Entities.
When to Run Each Check
When | What |
|---|---|
January | CPT and HCPCS updates, the new fee schedule, payer contract rates |
Each quarter | NCCI edits, HCPCS changes, an E/M sample, denial trends |
October 1 | ICD-10-CM update |
Every year | Risk analysis review, policies, training, the telehealth end date |
Every new hire or vendor | Exclusion check, access set-up, business associate agreement |
Frequently Asked Questions (FAQs)
What is medical billing compliance?
Medical billing compliance means submitting claims that accurately reflect the services provided, follow current CPT, ICD-10 and HCPCS coding standards, and meet payer and federal documentation requirements, including HIPAA privacy and security rules.
What are the biggest medical billing compliance risks in 2026?
The most significant risks include using outdated CPT/ICD-10 codes, E/M documentation that doesn't support the billed level of service, missing prior authorizations, incorrect modifier use, and HIPAA security gaps in digital billing systems.
How often should a practice update its coding systems?
At every release: CPT and HCPCS each January, ICD-10-CM each October 1, and HCPCS Level II and NCCI edits each quarter.
Should small practices outsource medical billing compliance?
Many small and mid-sized practices outsource billing and compliance monitoring because it gives them someone tracking rule changes, can reduce denial rates, and frees clinical staff from administrative upkeep.
How can Beeline Medical help with compliance?
Beeline Medical is a US company with a dedicated billing team. Its auditing and compliance service reviews a sample of your claims against the documentation and payer and CMS rules, reports what it finds in plain words, and builds the corrections into your billing process.
Where Beeline fits
Beeline's auditing and compliance page has "An audit-readiness self-check", a quick way to see where your practice stands against this list. To talk through the results, book a free consultation.