Earlier this year, armed federal agents and local police marched into a dermatology clinic during business hours. They separated patients from providers and spent the day hauling out computers and boxes of records. By the time they left, a practice that had opened its doors for patient care that morning looked like the subject of a criminal investigation. Because it was.
This was not the first time the federal government had come through that door. The practice had previously paid $6.6 million to settle False Claims Act (FCA) allegations1 and signed a corporate integrity agreement with the US Department of Health and Human Services Office of Inspector General (HHS-OIG). The FBI, HHS-OIG, and the Tennessee Bureau of Investigation executed search warrants across every location in the multisite practice the same morning. All of them. At once. No criminal charges have been announced. The investigation remains open.
Imagine that being your start to a patient care day. That case sits at the extreme end. Most practices will never witness the effects of an FBI raid up close and personal. But the enforcement pattern it represents has become more high-stakes as practices toe the line when chasing new revenue streams as reimbursement rates decline. Over the past decade, the federal government has increased surveillance into dermatology for billing fraud investigations, given the large number of lucrative minor procedures, and the legal actions and charges levied tell a consistent story: Mohs delegation violations, upcoding of wound closures, “incident-to” abuse, National Provider Identifier (NPI) misattribution, and billing practices that did not hold up when someone finally looked at the paperwork. Settlements have ranged from $141,000 to $8.9 million. Consequences beyond the dollar amount have included Medicare exclusion, which is career ending, and criminal prosecution carrying up to 10 years per count.1
Here is what none of those headlines mention: In many cases, the providers whose names were on the claims were not always the ones deciding how the billing worked. It is a function that often works unseen, behind the scenes in most practices. Often, providers never asked or bothered to find out. It is time we all knew how your name on the claim affects your future.
If your NPI appears on a claim, you own that claim. Not the billing department. Not the practice. You. If your operative note supports a code that does not match the procedure you performed, your documentation becomes the government’s first exhibit. The billing department works for the practice. Your NPI belongs to you. Those are 2 different things, and treating them as if they are not is how providers end up named in investigations they did not see coming.
While working on this column, I had the chance to collaborate with Faith C. McNicholas, RHIT, CPC, CPCD, PCS, CDC, senior manager at the American Academy of Dermatology and, in my view, the person you want in the room when the line between aggressive billing and fraudulent billing is at issue. McNicholas serves as the Academy’s liaison to the American Medical Association’s Current Procedural Terminology (CPT) Editorial Panel and the International Classification of Diseases, Tenth Revision Workgroup. I am a reasonably informed practice owner when it comes to coding and billing. McNicholas is the one helping write the codes. Her perspective runs through everything that follows.
The Rule Most Practices Get Wrong
Here is a scenario that plays out in medical dermatology offices across the nation every single day. A physician assistant (PA) sees an established patient for plaque psoriasis. The supervising physician is in the building, 3 doors down, charting between patients. The visit is billed under the physician’s NPI at 100% of the Medicare fee schedule using incident-to billing. Everybody is comfortable with this arrangement. The PA has been managing the patient’s psoriasis for 2 years. The physician is right down the hall. It all feels correct.
It is not. And the reason the coding and billing are wrong pertains to the regulations that many practices either do not know or have decided not to think about too carefully.
Incident-to billing allows a nurse practitioner (NP) or a PA’s services to go out under the supervising physician’s NPI at 100% of the fee schedule instead of the 85% the advanced practice provider would receive when billing independently.2,3 That 15% spread is why practices use it. But 3 conditions have to be met simultaneously, and the one that matters most is the one I almost never see discussed at the practice level: The physician must have personally seen the patient for that specific condition, made the diagnosis, and established the plan of care before the NP or PA can treat that condition under incident-to. If the physician never saw that patient for psoriasis, never documented the diagnosis, and never created the plan, then every visit billed incident-to for that condition has been invalid from the start. The physician being in the building does not fix it. The initiating visit never happened.
It gets tighter. If that same patient mentions a new mole during the psoriasis follow-up and the PA evaluates it, the process restarts. The physician has to see the patient for that concern, make the assessment, and establish a plan before the PA can bill incident-to for it. Most practices treat incident-to as purely a supervision question: Is the physician onsite and available? That is the third requirement. It is not the first two, and the first two are where the exposure lives. McNicholas confirmed what I suspected when I asked her about the supervision component. “The supervising physician must be immediately available via 2-way audio-video throughout the encounter,” she said. “Phone only or absence from the clinic does not qualify.”
The Centers for Medicare & Medicaid Services (CMS) made virtual direct supervision via real-time 2-way audio-video a permanent option effective January 1, 2026, for services without a 010 or 090 global surgery indicator.4 That is the updated rule on the third requirement. The first two have not changed since incident-to was codified. The physician sees the patient first, makes the diagnosis, and builds the plan. Then, and only then, can the PA or NP follow up on that condition under incident-to. In a busy medical dermatology practice where PAs and NPs carry their own panels, a large percentage of visits billed incident-to may never have had a qualifying initiating visit. That is not a gray area. It is a pattern of false claims.
Two physicians in Memphis, Tennessee, found out what that pattern costs. They paid $341,690 to settle FCA allegations after the government alleged that NPs treated patients billed at the physician rate without meeting incident-to requirements. The physicians were out of the office, including times when they were abroad. The case was brought under the FCA’s qui tam provisions, which allow a private individual to file suit on behalf of the federal government and collect a share of the recovery.1 The whistleblower received $58,087. The investigation consumed more than 2 years. The legal fees were not included in the settlement. And the practice’s name is now permanently searchable next to the words federal fraud.
One Surgeon, One Pathologist, Same Person
If incident-to is the rule most medical dermatology practices get wrong, the Mohs CPT definition5 is the one most surgical practices assume they are getting right. The definition is simple: The physician who excises the tissue must also interpret the histopathology. One surgeon, one pathologist, same individual. McNicholas does not leave room for interpretation:
“If Mohs surgical codes are reported and someone other than the surgeon performs the histopathologic review, the claim is invalid. It does not matter that the person reading the slides was a histotechnologist, a PA, an NP, or a different physician in the same practice or remotely. It is not an option.”
A multisite Southeast practice settled for $6.6 million on exactly this issue. A Midwest practice paid $1.63 million after staff alleged Mohs services had been billed under the physician’s NPI on days the physician was not present. And for PAs and NPs performing post-Mohs closures, the incident-to rules apply directly. The surgeon saw the patient and did the procedure, so the initiating visit requirement is met. But if the surgeon leaves for the day and is not available by real-time audio-video when you perform the closure, the supervision requirement fails. Every closure billed under the surgeon’s NPI after that point is a potential FCA violation.1
A Linear Closure Is a Linear Closure
This one should not require its own section, but it keeps generating settlements, so here we are. The distinction between a layered linear repair and a flap repair is not a judgment call. It is a coding boundary.5 “Billing adjacent tissue transfer when only a linear closure was performed or inflating the defect size to qualify for higher codes is upcoding. It is inappropriate. And it is illegal. Fraud to bill higher is never worth the risk,” McNicholas said.
A Florida practice settled for $847,394 in 2025 after a physician whistleblower alleged linear repairs billed as flaps and smaller flaps billed as larger flaps. A Georgia practice paid $1.9 million after the government found evaluation and management (E/M) codes billed the same day alongside procedures without a separately identifiable service. Modifier 25 abuse,6 McNicholas noted, “remains one of the most common compliance failures in most dermatology practices.” If you perform a layered linear closure and later discover the billing department coded it as a flap, that is not an administrative error you can set aside. That is a false claim built on your documentation. The responsibility to flag it is yours.
Before You Clock Out: Seven Things Worth Verifying
None of these requires legal training. All of them require a willingness to understand how the business side of your practice actually works.
1. Verify the initiating visit. For every condition treated under incident-to, has a physician personally performed the initial E/M, documented the diagnosis, and built the plan of care?2,3 A new concern means the physician sees the patient first. This is the requirement most practices fail, and it is the one worth checking before everything else.
2. Know your billing pathway. Are your services going out under your NPI or the physician’s? If incident-to, does the payer allow it? Ask the billing team. If they cannot answer, that tells you something worth knowing before you sign or renew.
3. Match your codes to your notes. Does the CPT code on the claim match the technique you actually documented? A layered linear repair billed as a flap is a false claim, regardless of who selected the code.
4. Pull your own production data. Request a sample CMS-1500 form with your NPI. You should be able to see what is being submitted under your credentials. If you cannot access that information, keep asking.
5. Read your indemnification clause. Does your contract tie billing clawbacks to your compensation? Know who absorbs the cost of a payer audit before it happens.
6. Confirm a compliance structure exists. Is there a process for raising coding concerns without retaliation? If not, that tells you something about the practice’s relationship with its own billing.
7. Check the OIG exclusion list. Every physician you work under should be verified at the HHS-OIG exclusion database.7 An excluded provider cannot bill federal programs, and the fallout does not stop with them.
The providers who get caught up in the drama of enforcement actions are not always the ones committing the fraud. But they may be the ones who did not ask the questions when there was still time.
Whose NPI Is on the Claim?
Every PA and NP in dermatology should be able to answer this question without hesitating, and most cannot. Are your encounters going out under your own NPI at 85% or under the physician’s at 100%? The answer depends on the payer, and that is where many practices get caught.
“Some private payers do not allow incident-to billing protocols. Some do not allow midlevel practitioners to report services under their individual NPI at all. Some private payers only allow the supervising physician’s NPI to be listed on the claim form,” McNicholas said. “Always check individual private payer claim reporting guidelines before services are rendered and adhere to them.”
Medicare allows incident-to. Many private payers do not. Practices that apply Medicare billing logic across every payer are submitting claims the payer never agreed to honor under those rules. A Tennessee hospital system settled for $141,000 after self-disclosing exactly that problem. And there is a contract dimension here that most providers ignore until it is too late: If your employment agreement contains a recoupment or indemnification clause tying billing clawbacks to your compensation and the practice has been billing your work under the wrong NPI, the financial exposure from a payer audit can flow directly to you. That is where the billing question and the contract question collide, and most providers have a blind spot worth tens to hundreds of thousands of dollars.
Who Is Watching
In most of the cases above, the investigation did not start with a random CMS audit. It started with someone inside the practice picking up the phone. The FCA’s qui tam provisions create a real financial incentive to do so: Whistleblower payouts in these dermatology cases range from $58,087 to $1.32 million.1 The whistleblowers were billing specialists, former directors, and staff-level employees: people who watched the gap between the examination room and the claim form widen until they decided it was worth a phone call. It happens. It happens more often than the industry acknowledges.
The FCA also prohibits retaliation.1 If you raise billing concerns and are fired, demoted, or frozen out, that is a separate legal claim carrying reinstatement, double back pay, and attorney’s fees. Retaliation does not make the problem go away. It adds a second lawsuit. And for PAs and NPs, this cuts both directions. You may be the one who notices the discrepancy. You may also be the provider whose work sits at the center of it. Under the FCA, “knowingly” submitting a false claim includes actual knowledge, deliberate ignorance, and reckless disregard.1 Choosing not to look does not protect you from the consequences of what you would have found.
The Line Is Clear
Reimbursement rates are declining. Overhead is climbing. The pressure to extract more from every encounter is real. But the response to margin pressure cannot be creative coding or losing your integrity to commit fraud. The FCA provides for treble damages, per-claim civil penalties currently ranging from $14,308 to $28,619, Medicare exclusion, and criminal prosecution carrying up to 10 years per count.1 The Medicare Payment Advisory Commission has recommended that Congress eliminate incident-to billing entirely.8 The OIG has announced that incident-to claims are under active review, with a report expected in 2026. Practices that are not billing clean should assume they are running out of runway.
A layered linear repair is a layered linear repair. Direct supervision means the physician is immediately available by a qualifying method. The physician must have seen the patient first and established the plan of care before incident-to applies. Mohs means one surgeon, one pathologist, same individual. These are definitions, not suggestions. And the people most likely to report a practice that treats these definitions as suggestions are the ones who work inside it.
Your name is on every claim, and it always has been. Now you know. Go ask the questions.
Joseph (Joe) Gatti, DMSc, MPAS, MBA, PA-C, is a board-certified dermatology physician associate, West Point graduate, and co-owner of a high-volume dermatology clinic and full-service medical spa. Through Azimuth Consultants, he advises clinicians nationwide on employment contracts, compensation strategy, and practice operations.
Disclosure: Gatti is the founder of Azimuth Consultants and maintains active ownership interests in a dermatology practice and medical spa.
References
1. False Claims Act, 31 USC §3729-3733.
2. Services and Supplies Incident to a Physician’s Professional Services: Conditions. 42 CFR §410.26 (2026).
3. Chapter 15: covered medical and other health services. In: Medicare Benefit Policy Manual. CMS. Updated May 8, 2026. Accessed June 15, 2026. https://www.cms.gov/medicare/prevention/prevntiongeninfo/downloads/bp102c15.pdf
4. Diagnostic X-Ray Tests, Diagnostic Laboratory Tests, and Other Diagnostic Tests: Conditions. 42 CFR §410.32 (2026).
5. CPT codes 17311-17315 (Mohs micrographic surgery), 12031-13160 (intermediate and complex wound repairs), 14000-14350 (adjacent tissue transfers). American Medical Association. Accessed June 15, 2026. https://www.cms.gov/medicare-coverage-database/view/article.aspx?articleid=53883&ver=26&
6. CMS Provider Compliance Tips on Modifier 25 and E/M Services. American Medical Association. Accessed June 15, 2026. https://www.ama-assn.org/practice-management/cpt/setting-record-straight-proper-use-modifier-25
7. Search the Exclusions Database. US Department of Health and Human Services Office of Inspector General. 2026. Accessed June 15, 2026. https://exclusions.oig.hhs.gov/
8. June 2019 Report to the Congress: Medicare and the Health Care Delivery System. Medicare Payment Advisory Commission. June 14, 2019. Accessed June 15, 2026. https://www.medpac.gov/wp-content/uploads/import_data/scrape_files/docs/default-source/reports/jun19_medpac_reporttocongress_sec.pdf
