Are You Liable for Your Medical Billing Company’s Mistakes?

For Medicare purposes, mostly yes. When a billing company submits a claim under your National Provider Identifier (NPI), Medicare treats it as your claim. CMS says so on the enrollment form every physician and practitioner signs: “Even if you use a billing agency/agent, you remain responsible for the accuracy of the claims submitted on your behalf” (Form CMS-855I, section 8).

That does not make every billing error fraud. Federal rules set up two separate duties. First, if you were paid money you were not owed, you must give it back once you know about it, no matter who made the mistake. Second, penalties under the False Claims Act need “knowing” conduct. In that law, knowing includes ignoring the truth on purpose or with reckless disregard.

This guide covers what stays with your practice when you outsource billing and what the billing company answers for. It also lists the checks that keep a vendor’s mistake from becoming your problem.

This article explains federal rules in general terms. It is not legal advice. For a decision about your own practice or contract, talk to a healthcare attorney.

Key Takeaways

• Medicare holds the enrolled practitioner responsible for the accuracy of claims a billing company submits, and it pays those claims in the practice’s name, never the billing company’s.
• An overpayment must be reported and returned within 60 days of being identified, no matter who caused it. A timely, good-faith investigation can pause that deadline for up to 180 days, and the lookback period is 6 years.
• False Claims Act liability needs knowing conduct, which includes deliberate ignorance and reckless disregard. No proof of intent to defraud is required.
• Your billing company must tell you about a HIPAA breach without unreasonable delay and within 60 days at most, but notifying patients is your job, and its knowledge of the breach may count as yours.
• Keep your own access to claims and remittances, spot-check claims against the chart, and write overpayment and breach rules into the contract.

Who is responsible for claims a billing company submits?

The practice is. Three facts put the claim on your side of the line, even when someone else keys it in and sends it.

You sign for it at enrollment. Section 8 of the CMS-855I, Medicare’s enrollment application for physicians and other practitioners, asks for your billing agency’s details. The same section states that you “remain responsible for the accuracy of the claims submitted on your behalf” (Form CMS-855I, revision 05/23).

Medicare pays you, not the billing company. A billing company can receive Medicare payments only as your agent, and “payment to an agent will always be made in the name of the supplier” (42 CFR 424.80(b)(5)). Medicare calls physicians, other practitioners and their group practices “suppliers.” If the agent does receive the money, its pay cannot be “related in any way to the dollar amounts billed or collected” (42 CFR 424.73(b)(3)). That is why practices on a percentage-of-collections contract have Medicare deposit straight into the practice’s own bank account.

The claim carries your number. Because the claim is billed under your NPI and paid to you, audits, denials and repayment requests come to the practice.

The short version: you can hand off the work, but not the responsibility for what the work produces. That is also why choosing a company carefully matters so much. Our guide on how to choose a medical billing company lists the questions to ask before you sign.

Can you be liable under the False Claims Act for your billing company’s errors?

You can, but only when the conduct meets the Act’s knowledge standard. The False Claims Act applies to any person who “knowingly presents, or causes to be presented, a false or fraudulent claim for payment or approval” (31 U.S.C. 3729(a)(1)(A)). The statute defines “knowingly” as actual knowledge, deliberate ignorance of the truth or falsity of the information, or reckless disregard of it, and it requires “no proof of specific intent to defraud” (31 U.S.C. 3729(b)(1)). Liability means three times the government’s damages plus a civil penalty for each false claim, adjusted for inflation.

An honest coding error is not on that list. For a practice that outsources, the risk is in the last two. Picture a practice that never looks at what is billed under its name, or that keeps hearing about problems with its vendor and does nothing. It is in a much weaker position than one that checks its claims and fixes what it finds.

OIG has warned physicians about this before. In a February 8, 2012 alert, it said physicians who reassign their Medicare payments to another entity “may be liable for false claims submitted by entities to which they reassigned their Medicare benefits,” and it encouraged “heightened scrutiny” before reassigning (OIG Alert). The alert followed settlements with eight physicians whose provider numbers were used to bill for services they did not perform or supervise.

A billing company working as your agent does not take a reassignment, so that alert does not apply to it directly. Its lesson does: OIG expects physicians to know what is being billed in their name. The Act also applies to the billing company itself, so a company that knowingly submits false claims is liable in its own right.

What happens when your billing company finds an overpayment?

You have 60 days to report and return it once it is identified, and that duty belongs to the practice. Under Medicare’s overpayment rule, “a person that has received an overpayment must report and return the overpayment” (42 CFR 401.305). The person who received the money is the provider or supplier, which is the practice, because Medicare paid the claim in its name.

The current rule, as amended in December 2024, works like this:

• When the clock starts. An overpayment counts as identified when the provider “knowingly receives or retains” it, with “knowingly” meaning the same as in the False Claims Act.
• 60 days. Report and return it within 60 days after it is identified, through your Medicare contractor’s refund or claim adjustment process.
• Up to 180 days to investigate. If you have found one overpayment and are running a timely, good-faith investigation into related overpayments from the same cause, the deadline is suspended until the investigation ends or until 180 days after the first one was identified, whichever comes first.
• Six years back. The duty covers overpayments identified within 6 years of the date the money was received.
• Keeping it has a price. An overpayment kept past the deadline becomes an “obligation” under the False Claims Act (42 CFR 401.305(e)).

The billing company is often the first to see an overpayment, such as a duplicate payment, a credit balance on an account, or a pattern in a denial review. OIG’s compliance guidance for billing companies says they “should institute procedures to provide for timely and accurate reporting to both the provider and the health care program of overpayments” (OIG Compliance Program Guidance for Third-Party Medical Billing Companies, 63 FR 70138, December 18, 1998).

Turn that into contract terms with dates. Say how many days the company has to tell you about a possible overpayment, who runs the review, who sends the refund, and that you approve it first. A monthly credit balance report is the simplest way to see refunds that are waiting. Our payment posting page explains where credit balances come from.

Who is responsible for a HIPAA breach at your billing company?

Both of you can be, and notifying patients stays with the practice. A billing company that handles patient information for you is a business associate. You may share protected health information with it only after you obtain “satisfactory assurance that the business associate will appropriately safeguard the information” (45 CFR 164.502(e)), documented in a written contract: the business associate agreement (BAA).

If the billing company has a breach of unsecured patient information:

• It must tell you “without unreasonable delay and in no case later than 60 calendar days after discovery of a breach” (45 CFR 164.410).
• You must notify each affected patient on the same standard: without unreasonable delay and no later than 60 calendar days after discovery (45 CFR 164.404).
• Its knowledge may count as yours. You are treated as knowing about a breach when any workforce member or agent of yours knows, “determined in accordance with the federal common law of agency” (45 CFR 164.404(a)(2)). If your billing company is your agent, your 60 days can start when it found the breach, not when it told you.
• Penalties can fall on both. HHS can impose civil money penalties on the practice, the business associate, or each of them. A covered entity is liable for violations by any agent, “including a workforce member or business associate, acting within the scope of the agency” (45 CFR 160.402(c)).

Whether your billing company counts as your agent depends on federal agency law and the facts, so ask your attorney how your contract reads. Either way, a BAA that only repeats the legal minimum leaves you short of time. Ask for notice within a few business days, so you can meet your own deadline. Our HIPAA compliance checklist for practices covers the rest of your HIPAA program.

What is the billing company responsible for?

Its own conduct, its own compliance program and whatever your contract says. Liability is rarely either-or.

• Under the False Claims Act, the Act reaches “any person,” so a billing company that knowingly submits or causes false claims is liable on its own.
• Under HIPAA, HHS can penalize a business associate directly for its own violations (45 CFR 160.402(a)), and the company must report breaches to you.
• Under OIG guidance, OIG expects billing companies to run a compliance program built on seven elements, to coordinate with their clients’ compliance officers, and “at a minimum,” to “send a copy of its compliance program to all of its provider clients” (OIG, 1998). OIG has not issued a newer version for billing companies. The 1998 guidance sits in OIG’s archive, next to its General Compliance Program Guidance from November 2023 (OIG compliance guidance).
• Under your contract, the company can agree to correct its errors at its own cost, give back its fee on claims it got wrong, indemnify you and carry errors and omissions insurance. Those terms decide who pays in the end between the two of you. They do not change who Medicare asks to repay, because Medicare paid you.

How do you reduce your risk when you outsource billing?

Treat the billing company as part of your compliance program: give it clear rules, check its work and keep records. Each step below follows one of the rules above.

1. Write the scope down. List the tasks the company does, such as coding, charge entry, claim submission, payment posting, denials and patient statements, and the tasks that stay in your office. A task nobody owns is where errors hide.
2. Keep your own access. Keep your own logins to the practice management system and the clearinghouse, and keep payer deposits going into the practice’s account. OIG’s alert notes that physicians who reassign have “unrestricted access” to claims billed under their numbers. With an agent, write the same access into the contract.
3. Spot-check claims against the chart. Each quarter, pull a sample of paid and denied claims and compare codes, modifiers and units with the documentation. OIG’s guidance recommends that billing companies review “a valid statistical sample of claims” at least once a year, before and after submission, so ask to see the results. An outside medical billing audit gives you a check by someone who did not bill the claims.
4. Set the overpayment rules. Agree in writing how fast the company must report a possible overpayment, who investigates, who processes the refund and who approves it.
5. Tighten the BAA. Set a breach notice period much shorter than 60 days, and require the company to get the same written assurances from any subcontractor that touches your patients’ data, as 45 CFR 164.502(e) requires.
6. Ask for its compliance program. Ask who its compliance officer is, how often coders are trained, and how it handles a suspected billing error.
7. Read the monthly report. Denial reasons, refunds, adjustments and write-offs show problems early. If a number moves sharply, ask why.
8. Act quickly on red flags. Start the review right away and write down each step. The 180-day suspension applies only to an investigation that is timely and in good faith.

If you are still deciding whether to outsource at all, our comparison of in-house vs outsourced medical billing covers cost and control.

How Summit Billing Solutions works with practices

Summit Billing Solutions was founded in 2023. It is headquartered in Salem, New Hampshire, and serves practices in all 50 states. We sign a business associate agreement with every practice before we handle any patient information, and we work inside your existing EHR and practice management system, in any specialty. Our first-pass claim rate is 95% to 98%. Our medical billing services page sets out the full scope.

Frequently Asked Questions About Medical Billing Company Liability