The Compliance Clinic: Chronic Care Management spotlight

Chronic Care Management spotlight: Billing, audit risk, and enforcement trends

The Compliance Clinic examines key Medicare, Medicaid, and government enforcement developments across the healthcare industry. Each edition focuses on a specific sector and provides an integrated view of compliance risk across the full enforcement life cycle, from billing and coding practices to audit exposure, enrollment consequences, and government investigations. 

Chronic care management lands in OIG’s crosshairs

The investigation letter from the Department of Health and Human Services, Office of Inspector General (OIG) arrives, requesting records and catching you by surprise. You followed the rules, as far as you understood them. You documented the care plan. You obtained patient consent. And yet the letter claims you may have overbilled chronic care management (CCM) services over the last two years. What went wrong? This scenario is becoming increasingly common. Many providers are making repeated “good faith” mistakes that develop into entrenched patterns and compliance issues when furnishing, coding and billing for CCM services.  

Investors in, and providers of, CCM services are better positioned to respond to OIG and other payors and enforcement bodies when potential billing gaps are identified before discrete issues turn into systemic risk. Regularly conducting billing and coding audits, including conducting such audits early in any deal process, allows providers and investors to surface operational and documentation issues promptly, address them, and respond appropriately if an OIG or other inquiry arises.

Why CCM, and why now? 

OIG has made it clear that CCM services are on its radar. In March 2026, OIG formally added CCM to its work plan, specifically focusing on whether beneficiaries have multiple chronic conditions that meet the requirements of the codes. This update followed other audits focused on CCM services. This is not a surprising trend. From 2019 to 2024, Medicare Part B payments for CCM services increased substantially, and like other services before it, CCM’s pattern of expansion and widespread adoption has prompted additional scrutiny.  

CCM services are not being reviewed in isolation. The CCM trend sits within a broader enforcement environment that has become more aggressive and data-driven. Programs such as the Centers for Medicare & Medicaid Services (CMS) Comprehensive Regulations to Uncover Suspicious Healthcare (CRUSH) program use artificial intelligence and advanced analytics to identify increases in utilization of particular services and other abnormal billing behavior. Where audits once occurred years after claims submission, regulators can now spot anomalies in near real time. That shift has significant consequences. In 2025 alone, CMS’s Fraud Defense Operations Center (FDOC) reported $1.8 billion in suspended payments.  

Where CCM compliance risks emerge

OIG is particularly focused on the threshold requirement for CCM eligibility: Patients must have two or more qualifying chronic conditions that are expected to last at least 12 months and that place them at significant risk of death, acute exacerbation, or functional decline. On paper, that standard is straightforward. In practice, documentation of these requirements often falls short.  

CCM services also include multiple time-based codes, which introduces a separate area of vulnerability. CPT codes such as 99490, 99439, 99487, and 99489 each require specific time thresholds and service expectations. Records that lack clarity around how time was tracked or what services were performed face scrutiny during audit.  

The value of independent compliance review

Training staff on billing and coding requirements is a necessary starting point, but relying on the same staff to audit their own documentation can create potential compliance concerns. An independent coding and billing review introduces objectivity, surfaces patterns, and identifies documentation practices that may not raise alarms day-to-day but can become problematic over the long term and draw scrutiny from investigators.  

CCM services are a key example of where an independent review is valuable. Coding and compliance requirements are complex, and the gaps between what is billed and what is adequately documented are not always visible. Even sophisticated healthcare providers and investors can struggle to determine whether claims are fully supported by the underlying medical record.  

For investors, that outside perspective can do more than identify compliance risk. It can uncover operational strengths, weaknesses, and opportunities that shape how an asset is ultimately valued and positioned, while also informing diligence findings, integration planning, and post-closing compliance priorities. 

Compliance as a business imperative

For providers and investors alike, the takeaway is straightforward: growth without disciplined compliance creates exposure. CCM services can be a component of a durable, valuable service line but only when supported by clear documentation, regular auditing, and a willingness to identify weaknesses early.  

Healthcare compliance and enforcement risk continue to evolve alongside changes in care delivery and reimbursement. The McDermott Will & Schulte healthcare regulatory and white-collar teams, in collaboration with Farragut Square Group, bring together deep experience in billing and coding, healthcare regulatory, and white-collar enforcement to help clients navigate complexity, mitigate risk, and strengthen compliance in an increasingly scrutinized environment.

Farragut Square Group’s Alana Zangl, Rita Ratner, Alina DiDonato, and Shira Klapper also contributed to this article.