How to Prevent, Detect, and Report Fraud, Waste, and Abuse in U.S. Healthcare: Step-by-Step Tutorial (2026)

How to Prevent, Detect, and Report Fraud, Waste, and Abuse in U.S. Healthcare: Step-by-Step Tutorial (2026)

By Nicole Statley, Healthcare Compliance Pros

Fraud, waste, and abuse (FWA) cost federal healthcare programs billions of dollars every year, and 2026 brings continued CMS and OIG scrutiny of provider compliance programs. Every organization that bills Medicare, Medicaid, or other federal healthcare programs carries a legal and ethical responsibility to prevent, detect, and report FWA, and that responsibility extends to every employee, not just compliance staff.

Understanding Fraud, Waste, and Abuse

CMS's training defines fraud as an intentional deception or misrepresentation made with the knowledge that it could result in an unauthorized benefit, while waste and abuse typically involve improper payments but do not require the same intent.

• Fraud: Knowingly submitting false claims or misrepresenting facts to obtain payment, such as billing for services never rendered or falsifying records.
• Waste: Overutilization of services or resources from deficient practices, such as ordering excessive, unnecessary tests without intent to defraud.
• Abuse: Practices inconsistent with accepted medical, business, or fiscal standards that result in unnecessary costs, such as billing for a higher level of service than provided.

Why the distinction matters:

• Fraud typically triggers civil or criminal investigation and significant penalties.
• Waste and abuse are often addressed through corrective education, policy changes, or repayment.
• Patterns of "abuse" that continue after notification can eventually be treated as fraud if intent becomes provable, which is why early correction matters.

Common FWA schemes affecting U.S. healthcare include:

• Upcoding (billing for a more expensive service than provided)
• Billing for services not rendered
• Unbundling procedures to inflate reimbursement
• Kickback arrangements between providers and referral sources
• Identity theft used to bill federal programs
• Billing for medically unnecessary services

These schemes aren't limited to large fraud rings; they frequently occur at the individual practice level through documentation shortcuts or misunderstood billing rules. Left unchecked, FWA drains resources from patient care, drives up costs across Medicare and Medicaid, undermines system trust, and exposes organizations to civil and criminal liability, program exclusion, and reputational harm.

Know the Laws:

Law	What It Prohibits	Key Citation
False Claims Act	Knowingly submitting false or fraudulent claims for payment to federal programs	31 U.S.C. § 3729
Anti-Kickback Statute	Offering, paying, soliciting, or receiving remuneration to induce referrals for federally reimbursed items or services	42 U.S.C. § 1320a-7b(b)
Stark Law (Physician Self-Referral Law)	Physician referrals for designated health services to entities with a financial relationship, absent an exception	42 U.S.C. § 1395

Key points on how these laws interact:

• A claim tainted by an Anti-Kickback Statute violation is automatically considered "false" under the False Claims Act.
• A single arrangement can trigger liability under more than one statute simultaneously.
• The Anti-Kickback Statute applies broadly to all federally funded healthcare services and items.
• The Stark Law's reach is narrower, applying specifically to physician self-referrals for designated health services paid by Medicare and Medicaid.

This distinction matters when structuring physician compensation, medical directorships, and space or equipment leases, all of which carry heightened scrutiny under both laws.

CMS training requirements to know:

• Medicare Advantage (Part C) and Part D plan sponsors, employees, governing body members, and first-tier, downstream, and related entities (FDRs) must complete FWA training.
• Training is due within 90 days of hire and annually thereafter.
• The requirement applies regardless of organization size; documentation of completion should be retained in the compliance audit trail.
• CMS offers a free MLN web-based module, "Medicare Fraud & Abuse: Prevent, Detect, Report," updated April 2026, that satisfies this obligation.

Whistleblower protections, at a glance:

• Employees who report suspected FWA in good faith, including under False Claims Act qui tam provisions, are shielded from retaliation.
• HHS-OIG maintains a hotline to receive tips from any source, including employees, patients, and members of the public.
• Retaliation against a good-faith reporter (termination, demotion, harassment) can create additional legal exposure independent of the underlying FWA issue.

Step-by-Step Prevention: Building a Resilient Compliance Program

An effective compliance program is proactive rather than reactive, tailored to the organization's size, service lines, and risk profile:

1. Establish written policies and a code of conduct defining FWA and behavioral expectations.
2. Designate a compliance officer and committee with direct reporting authority to leadership or the board.
3. Deliver FWA training to all staff, FDRs, and governing body members within 90 days of hire and annually thereafter.
4. Implement internal controls: claims review, segregation of duties, pre- and post-payment audits, and system-based edits.
5. Conduct routine risk assessments to catch billing anomalies and documentation gaps early.
6. Maintain an accessible, confidential reporting channel and publicize it regularly.
7. Screen all staff and contractors against federal exclusion lists.
8. Document every training session, audit, and corrective action taken.

Onboarding vs. annual training:

• New hires: Complete FWA training within 90 days, review the code of conduct, and sign an attestation.
• Annual refresher: Repeat training for all staff and FDRs, incorporate regulatory updates, and reassess risk areas specific to your billing patterns.

Ongoing risk monitoring checklist:

• Are annual FWA training completions tracked for all staff and FDRs?
• Are claims data reviewed regularly for anomalies like coding spikes or duplicate claims?
• Is there a documented process for excluding sanctioned individuals from federal program participation?
• Are policies reviewed annually against current CMS and OIG guidance?
• Is the reporting hotline tested periodically to confirm it works and staff know how to use it?

Detecting and Responding to FWA Incidents

Common red flags to watch for:

• Billing for services on dates the patient was not seen
• Unusually high volumes of high-level evaluation and management codes relative to peers
• Duplicate claims for the same service
• Referral patterns tracing back to entities with financial ties to the referring provider

Scenario: A compliance officer notices one physician consistently bills the highest-level evaluation code regardless of visit complexity, well above peer benchmarks. This alone doesn't prove fraud, but it's exactly the anomaly internal auditing should flag for chart review, documentation comparison, and, if needed, provider education before it becomes a larger liability.

When a concern arises, document:

• The date the concern was identified
• Individuals involved
• Specific claims or transactions in question
• Supporting data, such as billing reports or medical records

Thorough documentation protects both the organization and the reporting employee and creates the evidentiary foundation needed if the matter proceeds to external investigation.

Reporting paths:

• Internal reporting: Route the concern to the compliance officer or hotline for investigation, root-cause analysis, and corrective action (repayment, policy revision, or discipline).
• External reporting: Serious or unresolved concerns should go to HHS-OIG via its hotline (1-800-447-8477) or online portal. CMS also maintains channels specific to Medicare Parts C and D concerns.

Internal reporting is never a substitute for external reporting when the law requires it, and staff should understand that reporting externally is protected activity, not a breach of loyalty.

Certification, Resources, and Ongoing Education

Completing and maintaining certification:

• Staff and FDRs can complete CMS's free MLN web-based module or an accredited equivalent.
• Document completion for the organization's compliance file.
• Review and refresh materials at least annually, or sooner if CMS issues new rules.

Certification is one input into a broader culture of compliance, not the end goal:

• Treating FWA training as a checkbox exercise tends to produce lower long-term effectiveness.
• Embedding short scenario-based refreshers throughout the year keeps awareness active rather than something staff think about once annually.

Healthcare Compliance Pros offers role-based FWA training modules, hotline solutions, and ongoing policy update support designed to help U.S. providers meet these federal training mandates efficiently. Pairing CMS-required training with structured internal auditing and a clear escalation path creates a defensible, continuously improving compliance posture.

FAQ: Fraud, Waste, and Abuse in 2026

Do all healthcare staff need FWA training every year?
Yes. CMS requires Medicare Parts C and D plan sponsors and their FDRs to complete FWA training within 90 days of hire and annually thereafter.

What's the difference between fraud and abuse?
Fraud requires intentional deception for financial gain; abuse involves improper billing or practices that don't meet accepted standards but lack proven intent.

Where do I report suspected healthcare fraud?
Report internally to a compliance officer or externally to the HHS-OIG hotline at 1-800-447-8477 or through its online portal.

Are whistleblowers protected if they report FWA?
Yes, federal law protects against retaliation for good-faith reporters, including under the False Claims Act's qui tam provisions.

Can an Anti-Kickback Statute violation also violate the False Claims Act?
Yes. Claims resulting from a kickback arrangement are automatically considered false under the False Claims Act.

How is the Stark Law different from the Anti-Kickback Statute?
The Anti-Kickback Statute covers all federally funded healthcare services broadly, while the Stark Law applies specifically to physician self-referrals for designated health services paid by Medicare and Medicaid.

Does completing this tutorial guarantee compliance?
No. This tutorial is educational and does not guarantee compliance with all applicable federal or state requirements. Organizations should consult qualified legal counsel for complex FWA situations and verify current regulatory requirements directly with CMS and OIG.