Civil Monetary Penalties Law: Conduct, Liability, and Exclusion

The Civil Monetary Penalties Law is the federal statute that lets the Office of Inspector General at the Department of Health and Human Services fine anyone who submits false claims to Medicare or Medicaid, pays or receives kickbacks, or otherwise defrauds federal healthcare programs. Per-violation penalties currently run from roughly $6,400 to nearly $128,000, and the government can add an assessment of up to three times the amount improperly claimed.¹ Because these are administrative proceedings rather than criminal prosecutions, the OIG moves faster than a prosecutor and does not have to prove its case beyond a reasonable doubt. Combined with the threat of exclusion from federal programs, that makes it one of the most consequential enforcement tools a healthcare provider can face.

Conduct That Triggers a Penalty

The core prohibition targets anyone who submits a claim for an item or service that wasn’t provided as described. Upcoding, where a provider bills for a more expensive procedure than the one actually performed, falls here. So does billing for services never delivered, claims for medically unnecessary services submitted in a pattern, and claims for services provided by someone excluded from federal healthcare programs.¹

Kickback arrangements are a second major category. Offering, paying, soliciting, or accepting anything of value to steer patient referrals violates the statute, regardless of whether the underlying medical services were actually needed.¹ Kickback violations also carry the highest per-violation cap under the law.

Beneficiary inducements are prohibited too. Gifts, free services, or waived copayments designed to steer Medicare or Medicaid patients toward a particular provider can trigger penalties of up to $25,595 per item or service involved.² Narrow exceptions cover copayment waivers granted after a genuine determination of financial need, incentives tied to preventive care, and retailer coupons or rewards offered to the general public regardless of insurance status.³

The remaining categories cover employing or contracting with someone the provider knows is excluded from federal programs (even if the excluded person’s work is competent), making false statements on enrollment applications, failing to report and return known overpayments, and refusing OIG access for audits and investigations.¹

Emergency department violations also fall under the same enforcement structure. Hospitals that fail to provide an appropriate medical screening or stabilizing treatment to emergency patients face penalties of up to $50,000 per violation, dropping to $25,000 for hospitals with fewer than 100 beds. Individual physicians responsible for the screening, treatment, or transfer face the same exposure.⁴⁵

You Don’t Have to Intend Fraud

The government does not have to prove that anyone set out to commit fraud. Under the statute, “should know” means acting in deliberate ignorance of whether information was true or false, or in reckless disregard of its truth or falsity.¹ No specific intent to defraud is required. A billing manager who ignores obvious red flags in coding patterns, or a practice owner who never checks whether new hires appear on the exclusion list, can face the same penalties as someone who deliberately fabricated claims. That low knowledge threshold is a large part of why the CMPL is so effective compared to criminal prosecution, where willful intent must be proved.

How Much the Penalties Are

Penalties apply per violation and are adjusted annually for inflation. Under the 2026 inflation adjustment, the current per-violation maximums are:²

False claims, upcoding, excluded-person billing, or unreturned overpayments: up to $25,595
Misleading information influencing a hospital discharge decision: up to $38,393
Refusing to grant OIG access for audits or investigations: up to $38,393
False records material to a fraudulent claim: up to $72,163
Kickback violations or false statements on enrollment applications: up to $127,973

Per-violation figures add up quickly. A provider who submitted 200 upcoded claims faces potential exposure of over $5 million in penalties before anything else is added. And there is more to add. The statute authorizes an assessment of up to three times the amount improperly claimed for each item or service.¹ For kickback violations, the treble assessment applies to the total remuneration involved, regardless of whether any portion had a legitimate purpose. Combine per-violation penalties with treble assessments and a case involving modest individual claims can turn into a multimillion-dollar liability.

Within those caps, the OIG weighs the nature and circumstances of the claims, the degree of culpability, the violator’s history of prior offenses, and the violator’s financial condition, plus a catch-all for “such other matters as justice may require.”¹ Deliberate fraud schemes draw penalties near the statutory caps; honest coding mistakes caught late do not. Prior enforcement history weighs heavily.

Who Can Be Held Liable

The statute defines “person” broadly to include individuals, partnerships, corporations, trusts, and any other public or private entity.³ Physicians, nurses, therapists, laboratory technicians, and pharmacists all face direct personal liability for claims they submit. The statute captures anyone who “presents or causes to be presented” a false claim, so the person who signs the form and the person who directed them to submit it are both exposed.¹

Organizations are on the hook as well. Hospitals, clinics, nursing facilities, and diagnostic centers can be held responsible for violations committed by their employees. Third-party billing companies are not insulated by their contractor status: if the billing company knew or should have known the claims were improper, it faces the same framework as the provider.

Buyers of Healthcare Businesses

Acquisitions can carry the seller’s CMPL exposure with them. Federal courts have held that when a buyer accepts the automatic assignment of the seller’s Medicare provider agreement, the buyer takes on liability for the seller’s existing overpayments and penalties. A buyer can avoid this by rejecting the automatic assignment and applying for a new provider agreement, though that may delay Medicare certification and create a reimbursement gap. Corporate Integrity Agreements also bind successors and transferees, so a buyer who takes over a facility already under a CIA must comply with every term or risk exclusion.⁶

The Consequences That Aren’t Money

The monetary penalty is often not the worst part of a CMPL case.

Exclusion From Federal Healthcare Programs

The OIG maintains the List of Excluded Individuals and Entities, and a CMPL case can lead directly to placement on it. Mandatory exclusions carry a minimum five-year ban for convictions related to healthcare fraud, patient abuse, or controlled substances. A second mandatory exclusion offense doubles the minimum to ten years, and a third triggers permanent exclusion.⁷ Permissive exclusions, imposed at OIG discretion, run one to three years depending on the underlying conduct. For a provider whose patient base is mostly Medicare or Medicaid, exclusion effectively ends the practice.

Corporate Integrity Agreements

When the OIG settles a case without imposing full exclusion, it often requires the provider to enter a Corporate Integrity Agreement. These typically last five years and impose ongoing compliance obligations: a dedicated compliance officer, an independent reviewer auditing billing practices, screening all employees and contractors against the exclusion list, and annual reports to the OIG.⁶ Breaching a CIA can itself lead to monetary penalties or exclusion.

National Practitioner Data Bank Reporting

Adverse actions from CMPL violations, including the penalty amount, get reported to the National Practitioner Data Bank. Hospitals, health plans, and licensing boards see these reports during credentialing reviews.⁸ Even after the penalty is paid and any exclusion period ends, the NPDB record persists and can affect hospital privileges, network participation, and licensing for years.

Self-Disclosure Before the Government Finds It

Providers who identify potential fraud inside their own organization can use the OIG’s Provider Self-Disclosure Protocol to report it voluntarily before the government finds it independently. The protocol is open to any healthcare provider, supplier, or person subject to the OIG’s penalty authority.⁹

Cases resolved through self-disclosure tend to produce substantially lower penalty amounts and a reduced likelihood of exclusion, though the OIG retains full discretion over the outcome. Entities already operating under an Integrity Agreement must contact their OIG monitor before submitting a self-disclosure. The protocol cannot be used to report someone else’s conduct; those complaints go through the OIG hotline.

Contesting a Penalty

The government must provide written notice and an opportunity for a hearing before making a final adverse determination.¹ The notice sets out the specific allegations, the legal basis, and the proposed dollar amount. Anyone who receives one should start pulling claim records, medical charts, coding records, and any correspondence with federal agencies bearing on the allegations right away.

The respondent has 60 days from receipt of the notice to submit a written hearing request to the Departmental Appeals Board. Receipt is presumed to be five days after the notice was sent, unless the respondent can show otherwise.¹⁰ Missing the deadline forfeits the right to contest, and the OIG can impose the proposed amount without further proceedings. The DAB uses mandatory electronic filing through its E-File system, though non-federal parties may use paper for the initial submission.¹¹

Once a hearing is requested, an Administrative Law Judge is assigned. The ALJ oversees discovery, schedules the hearing, and allows both sides to present witnesses and cross-examine. The ALJ can increase, decrease, or eliminate the proposed penalty based on the evidence. An unfavorable decision can be taken to the United States Court of Appeals for the circuit where the respondent resides or where the claim was filed, with the petition due within 60 days of the Secretary’s final determination.¹

How Far Back the Government Can Reach

The Secretary cannot bring a CMPL action more than six years after the claim was submitted, the payment was requested, or the prohibited conduct occurred.¹ Old billing irregularities can still produce exposure years after the conduct stopped, which is one reason early self-disclosure tends to pay off: it prevents further violations from stacking up inside the six-year window.

How This Differs From the False Claims Act

Providers facing fraud allegations frequently see both the CMPL and the False Claims Act invoked, and it is worth knowing they are not interchangeable. The False Claims Act is a litigation tool. Cases are filed in federal court, either by the Department of Justice or by private whistleblowers under qui tam provisions, and successful plaintiffs recover treble damages plus per-claim penalties. The CMPL is administrative. The OIG initiates the case internally, there is no whistleblower provision, and proceedings run through the Departmental Appeals Board rather than a federal courtroom.

The practical difference matters. False Claims Act cases tend to be larger, slower, and driven by relators who share in the recovery. CMPL actions move faster, reach a wider range of misconduct, and don’t require a federal court’s involvement. The OIG can pursue CMPL penalties alongside or independently of a False Claims Act case, so a single course of conduct can generate liability under both.

1
Office of the Law Revision Counsel. 42 USC 1320a-7a – Civil Monetary Penalties
2
Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
3
eCFR. 42 CFR Part 1003 – Civil Money Penalties, Assessments and Exclusions
4
Office of the Law Revision Counsel. 42 USC 1395dd – Examination and Treatment for Emergency Medical Conditions and Women in Labor
5
eCFR. 42 CFR 1003.500 – Basis for Civil Money Penalties and Exclusions
6
Office of Inspector General. Corporate Integrity Agreements
7
Office of Inspector General. Exclusion Authorities
8
eCFR. 45 CFR Part 60 – National Practitioner Data Bank
9
Office of Inspector General. Health Care Fraud Self-Disclosure
10
eCFR. 42 CFR 1005.2
11
Departmental Appeals Board. Departmental Appeals Board E-Filing System