Fraud, Waste, and Abuse for Health Care Providers

What is Fraud, Waste, and Abuse?

Fraud is an intentional or deliberate act to deprive another of property or money by deception or other unfair means.  The ways in which fraud occurs are as unique as the individual perpetrators, their motives, and the situations they exploit.  For the purposes of this training, fraud is intentionally submitting false information to the Government (including situations in which you should have known the information was false) to get money or a benefit.

Waste includes practices that, directly or indirectly, result in unnecessary costs to federally funded programs, such as overusing services.  Waste is generally not considered to be caused by criminally negligent actions but rather by the misuse of resources.

Abuse includes actions that may, directly or indirectly, result in unnecessary costs to federally funded programs.  Abuse involves paying for items or services when there is no legal entitlement to that payment.

The Fraud Triangle below illustrates the three elements that are often present in environments where fraud occurs.  The elements are 1) pressure, 2) opportunity, and 3) rationalization.  By considering the three sides of The Fraud Triangle when creating internal control strategies, your organization can help prevent and root out fraud.

Select the tabs below to learn more about the elements of The Fraud Triangle.  For easy reference, a job aid is at the bottom of the page.

Red Flags

In addition to the vulnerabilities in The Fraud Triangle examples, below are some red flags that might indicate fraud, waste, or abuse.  As you review these issues, think about your organization and the internal controls you could put in place to identify these issues early.  

Click on each flag to learn more.

Issues with Documentation

• Abnormal billing patterns indicating overutilization of services
• Listing incorrect procedures in medical charts (usually listing a more expensive procedure than what was actually performed)
• Listing incorrect or unnecessary expensive medications

Changes in Attitudes or Performance

• Unreasonable explanations and attitudes including annoyance at questions
• Deviation from standard procedures
• Decrease in quality of work
• Preventing full transparency on issues regarding money, such as review and approval of expenses

Financial Red Flags

• Unexplained spending beyond one's income
• Shifting costs from one account to another
• Use of several different banks or bank accounts, or frequent bank changes

What are Some Examples of Health Care Fraud?

Below are a few examples of fraud that can happen in grant programs:

1. submitting false claims, such as claims for services that were not provided;
2. inflating costs reported on cost reports;
3. diverting prescription drugs;
4. offering or receiving kickbacks for patient referrals; and 
5. providing medically unnecessary care.

The_Fraud_Triangle

299.6 KB

Office of Inspector General

A key component of OIG's mission is to detect and root out fraud in Federal health care programs, including Indian Health Service (IHS), Medicare, and Medicaid.  OIG takes steps to fight fraud, waste, and abuse in Health and Human Services (HHS) programs by:   

• preventing, detecting, and deterring fraud, waste, and abuse;
• fostering sound financial stewardship and reduction of improper payments; and
• holding wrongdoers accountable and recovering misspent public funds.

OIG Components

OIG carries out its mission using a multidisciplinary, collaborative approach, with six components playing a vital role in Government oversight. 

OIG Work in AI/AN Communities

Under the Inspector General Act of 1978, as amended, OIG has the statutory responsibility to provide oversight over all HHS programs.  Specifically, OIG has the duty to investigate fraud, waste, and abuse and promote the economy and efficiency of HHS programs, typically through audits and evaluations.  The subjects of our audits, evaluations, and investigations include, but are not limited to:

• fraudulent use of grant funds related to HHS programs such as the Low Income Home Energy Assistance Program, Temporary Assistance for Needy Families, and Head Start;
• quality of care;
• ineffective program internal controls;
• IHS employee misconduct;
• Medicare and Medicaid fraud;
• prescription drug diversion;
• benefit enrollment fraud; and
• Tribal 638 program fraud.

Examples of OIG work 

OIG oversight seeks to improve the economy and efficiency of HHS’s AI/AN programs, as well as to fight fraud, waste, and abuse.  

Select each tab below to see examples of OIG's work.

In the lessons that follow, we go into greater detail regarding the Federal laws that OIG enforces to prevent or prosecute fraud committed against HHS programs.  In addition to the legal authorities addressed in those lessons, individuals and entities suspected of engaging in fraud may be criminally charged under a wide variety of other Federal criminal statutes.  See the Resources to Help You section for links to resources that provide more information.

OIG Fraud, Waste, and Abuse Prevention Efforts

OIG conducts investigations, audits, and evaluations pursuant to its duties as listed in the Inspector General Act of 1978; however, OIG is also funded to engage in fraud, waste, and abuse prevention efforts.  OIG has several such prevention efforts in place, including providing education to grantees through presentations and publishing audits, evaluations, and trainings like this one.

OIG Prevention Efforts in the AI/AN Community

OIG engages the AI/AN community to proactively avert fraud, waste, and abuse.  Select each tab to learn about these efforts.

Join OIG in Preventing Fraud, Waste, and Abuse

There are many ways you can join in the fight to prevent fraud, waste, and abuse.  One way is to establish a compliance program to proactively avoid the vulnerabilities we've covered.  Another way is to build robust internal controls as part of your compliance program.  You can also use a single audit as an effective tool to help your organization. Check out our website, oig.hhs.gov/aian, for trainings on these topics.

We are all responsible for preventing fraud, waste, and abuse in HHS programs.  If fraud, waste, and abuse are suspected, it is also our responsibility to report information that suggests dishonest or illegal activities involving HHS programs.

OIG Hotline 

One method of reporting fraud, waste, or abuse is to contact the OIG Hotline.  The OIG Hotline accepts tips and complaints from all sources about potential fraud, waste, and abuse in HHS programs.  Complaints can be anonymous, and confidentiality can be requested (more information here).

Select the plus sign on each tab below to learn what you should do before you submit a complaint.

Below is a job aid with the basics on reporting fraud, waste, and abuse to OIG.

Job Aid:

Reporting_to_the_OIG

189.6 KB

The False Claims Act (FCA) (31 U.S.C. § § 3729-3733) allows the Federal Government to recover damages and penalties from entities that knowingly submit, or knowingly cause to be submitted, false or fraudulent claims to the Federal Government, including to Medicare or Medicaid.   Basically, the FCA protects the Government from being overcharged, mischarged, or sold shoddy goods or services.  The FCA defines "knowingly" to include not only actual knowledge but also instances in which the person acted in deliberate ignorance or reckless disregard of the truth or falsity of the information.

The FCA prohibits filing a claim for an item or service that was not actually provided as claimed.  Every time you submit a claim, you are, essentially, certifying that all the criteria for payment for that item or service on that claim have been met. 

Read the scenario below and choose the best answer.

A Tribal Department of Human Services (DHS) provides a group therapy session to 15 children once each week. However, the Department’s psychologist, who conducts the sessions, falsely documents the services as if he provided one-on-one therapy sessions, which are more expensive, to 15 children each week. Consequently, the DHS bills Medicaid for 15 one-on-one sessions rather than one group session.

Could the psychologist be liable under the FCA?

Could anyone at DHS be liable?

Liability under the FCA can also stem from making a false record or statement or from billing for “worthless” services—that is, when services that fall so far below the standard of care that they are, essentially, worthless.    

Knowingly retaining a government overpayment may also give rise to liability under the FCA.  Health care providers that identify an overpayment of Medicare or Medicaid funds must report and return those funds within 60 days or risk exposure under the FCA and other penalties. 

FCA lawsuits can be filed by the Federal Government and by whistleblowers, or relators, on behalf of the Federal Government. 

Liability under the FCA may be up to three times the amount paid plus a sizeable per claim penalty.  For example, a provider who submits 100 false claims worth an aggregate of $500,000 may be liable for up to $1.5 million plus an additional penalty for each of the 100 claims.

The Civil Monetary Penalty Law (CMPL) (42 U.S.C. § 1320a-7a) protects the Government from a variety of improper conduct, including the submission of false claims related to HHS grant programs, Federal contracts, or Federal health care programs. 

Both the FCA and the CMPL are used to address similar improper conduct. The Department of Justice partners with Federal entities like HHS, OIG, and IHS to bring cases under the FCA in Federal court.  The CMPL is an alternate remedy in which OIG can initiate cases before an HHS administrative law judge.

OIG has the authority to seek penalties and exclusion from Federal health care programs against an individual or entity based on a wide variety of prohibited conduct related to Federal health care programs, HHS grants, and HHS contracts. The amount of civil monetary penalties imposed by the Government depends on the conduct but can be up to $20,000 per claim for the submission of false claims. In addition to that amount, the Government may seek to recover up to three times the amount of damages, or loss to the program.

OIG may seek penalties under the CMPL against individuals or entities that:

1. submit claims to Federal health care programs that the individual or entity knows or should know are for an item or service that was not provided as claimed or is false or fraudulent;
2. engage in fraud and other improper conduct related to HHS grants, contracts, and other agreements; or
3. knowingly and willfully: (1) offer or pay remuneration, directly or indirectly, to induce referrals of Federal health care program business or (2) solicit or receive remuneration, directly or indirectly, in return for referrals of Federal health care program business.

The Federal Anti‐Kickback Statute (AKS) (42 U.S.C. § 1320a-7b(b)) is a criminal law that prohibits the knowing and willful exchange, offer to exchange, solicitation, or receipt of anything of value in an effort to influence, induce, or reward the referral of Federal health care program business, including the referral for Medicare, Medicaid, or IHS items and services, and arranging for or recommending such items and services. 

Examples of improper kickback relationships include the following:

1. A diagnostic lab offers a nurse practitioner $100 for each Medicare referral.
2. An oncologist takes family vacations paid for by a pharmaceutical company in exchange for prescribing the company’s drug in lieu of alternatives.
3. A medical equipment company and a physician agree that the physician can establish a rent-free office in a space owned by the medical equipment company if the physician refers Medicaid patients to the company. 

It is important to understand that submitting a claim to Medicare, Medicaid, or another Federal health care program that was the result of a kickback scheme, in addition to violating the criminal AKS, can also lead to liability under the FCA.

Let’s revisit the last scenario but change the facts a bit.  Read the scenario below and choose the best answer.

Scenario 1: DHS provides mental health services to local school children in the community. It provides both one-on-one and group therapy services, and bills Medicaid accordingly. The director of DHS has increased DHS’s Medicaid referrals and billings by paying a school official $100 for every child who is referred to a Tribal health facility operated by DHS for services.

There are statutory exceptions and regulatory safe harbors to the AKS that carve out certain circumstances in which it may be acceptable to provide a form of remuneration related to a referral. It is important to consult with legal counsel before relying on these exceptions and safe harbors.

Violations of the AKS may lead to criminal liability and prosecution, liability under the FCA for the submission of false claims, liability under the CMPL, and exclusion from participation in Federal health care programs.

Scenario Question 1: Could the DHS director be liable under the AKS?

Scenario Question 2: Could the school official be liable under the AKS?

There are statutory exceptions and regulatory safe harbors to the AKS that carve out certain circumstances in which it may be acceptable to provide a form of remuneration related to a referral. It is important to consult with legal counsel before relying on these exceptions and safe harbors.

Violations of the AKS may lead to criminal liability and prosecution, liability under the FCA for the submission of false claims, liability under the CMPL, and exclusion from participation in Federal health care programs.

The Prohibition on Certain Physician Referrals (42 U.S.C. § 1395nn) is frequently referred to as the “Stark Law,” after Peter Stark, the former member of congress credited for the law’s enactment.

The Stark Law prohibits physicians from referring Medicare and Medicaid patients for “designated health services” (e.g., inpatient and outpatient hospital services, home health care services, clinical laboratory services, physical therapy, speech therapy, etc.) to entities with which the physician or an immediate family member has a financial relationship (ownership, investment, or compensation).  Additionally, the entities are prohibited from presenting or causing to be presented claims to Medicare or Medicaid (or billing another individual, entity, or third-party payer) for those referred services. For example, under the Stark Law, a general physician is prohibited from referring a patient to a physical therapy office that is owned by his wife unless an exception applies.  As another example, a physician who is an employee of a hospital, and refers patients to that hospital, may not be paid above fair market value by the hospital.

The Stark Law has certain statutory and regulatory exceptions.  Again, consult legal counsel before relying on them.

The Stark Law is a strict liability statute, which means proof of specific intent to violate the law is not required. That is, technical violations committed unknowingly can still lead to liability and the imposition of penalties authorized in the Stark Law.

Violations of the Stark Law committed with the requisite intent can lead to liability under the FCA and CMPL, as well as exclusion from participating in Federal health care programs.

OIG has authority (42 U.S.C. § 1320a-7) to exclude an individual or entity from participation as a provider or supplier in Federal health care programs, including Medicare, Medicaid, and IHS, among others.  

The effect of an OIG exclusion is that no Federal health care program payment may be made for any items or services furnished (1) by an excluded person or (2) at the medical direction or on the prescription of an excluded person.  The exclusion and the payment prohibition continue to apply to an individual even if he or she changes from one health care profession to another while excluded. This payment prohibition applies to all methods of Federal health care program payment, whether from itemized claims, cost reports, fee schedules, capitated payments, a prospective payment system, other bundled payment, or other payment system and applies even if the payment is made to a State agency or a person that is not excluded. 

For example, no payment may be made to a hospital for the items or services furnished by an excluded nurse to Federal health care program beneficiaries, even if the nurse’s services are not separately billed and are paid for as part of a Medicare diagnosis-related group payment received by the hospital. Also, the excluded nurse would be in violation of her exclusion for causing a claim to be submitted by the hospital for items or services the nurse furnished while excluded.

There are two general types of exclusion.

Mandatory Exclusions

Mandatory exclusions are exclusions that OIG must impose. Conduct that would result in a mandatory exclusion includes criminal convictions relating to Medicare or Medicaid fraud, patient abuse or neglect, and felony convictions related to controlled substances.

Permissive Exclusions

Permissive exclusions are exclusions that OIG, in its discretion, may impose. Conduct that could result in a permissive exclusion includes misdemeanor offenses related to health care fraud, misdemeanor offenses related to controlled substances, loss of professional license in certain circumstances, and defaulting on student loans.

The Effects of Exclusion

The effect of exclusion is that no payment shall be made by Medicare, Medicaid, IHS, or any other Federal health care program for services furnished, ordered, or prescribed by a person or entity who is excluded. This prohibition on payment applies even when the excluded person would only indirectly receive payment, for example, when a hospital bills Medicare for services provided by an excluded nurse.

If a health care provider arranges or contracts (by employment or otherwise) with a person who the provider knows or should know is excluded by OIG, the provider may be subject to Civil Monetary Penalty (CMP) liability if the excluded person provides services payable, directly or indirectly, by a Federal health care program.  A provider could be subject to CMP liability if an excluded person participates in any way in the furnishing of items or services that are payable by a Federal health care program.  To address this risk area, health care providers should screen their employees and contractors against OIG’s List of Excluded Individuals and Entities at the time of hire and routinely thereafter. The List of Excluded Individuals and Entities is an online searchable database of providers that are excluded. OIG maintains and updates this list monthly.  Read more about OIG’s Exclusion Program and OIG's Exclusion Authorities.  See below for a job aid that will give you more information about OIG's Exclusion process and how to screen for excluded providers.

Job Aid

OIG_Exclusion_and_Screening_for_Exclusions

183.8 KB

OIG has established a Health Care Fraud Self-Disclosure Protocol (the Protocol) through which your organization can self-disclose violations if it discovers that it has violated the laws we just covered.  Specifically, the Protocol is available to facilitate the resolution of matters that, in the disclosing party’s reasonable assessment, potentially violate Federal criminal, civil, or administrative laws for which CMPs are authorized.  For example, a provider may disclose false billing or employment of an excluded individual.

The disclosing party is expected to conduct an internal investigation and to report its findings to OIG in its submission.  If the Protocol’s requirements are met it may reduce your organization’s monetary and exclusion liability.  Self-disclosures to OIG are generally resolved with a CMP settlement.  

All health care providers, suppliers, or other individuals or entities who are subject to OIG’s CMP authorities found at 42 CFR § 1003 are eligible to use the Protocol.  The Protocol is not limited to any particular industry, medical specialty, or type of service.

Resolution and Benefits of Self-Disclosure

OIG recognizes that the question of whether to disclose potential fraud to OIG is a significant decision.  However, self-disclosure has benefits.  OIG believes that good faith disclosure of potential fraud and cooperation with OIG's resolution process are indications of a robust and effective compliance program.  As a result, OIG generally provides a release of its permissive exclusion authority without requiring the disclosing entity to enter an integrity agreement.  OIG also believes that individuals or entities that use the Self-Disclosure Protocol and cooperate with OIG deserve a lower penalty amount than would normally be required in a Government-initiated action.  Finally, using the Protocol may mitigate potential exposure related to the regulatory requirement to report and return Medicare and Medicaid overpayments within 60 days. 

Below please find a summary of the Self-Disclosure for Health Care Providers process and the Health Care Fraud Self-Disclosure Protocol.

Job Aids

Health_Care_Fraud_Self-Disclosure_Process

293.9 KB

Health_Care_Fraud_Self-Disclosure-Protocol

521.8 KB

We address two risk areas below—quality-of-care and submission of accurate claims—but we encourage you to visit the OIG website for more information. 

Quality-of-Care

In cases that involve poor care on a systemic and widespread basis, the health care facility may be liable for submitting false claims for reimbursement to the Government under the FCA, the CMPL, or other authorities that address false and fraudulent claims or statements made to the Government.  Thus, compliance with applicable quality-of-care standards and regulations is essential for the lawful behavior and success of health care facilities.

Submission of Accurate Claims

Common and longstanding risks associated with claim preparation and submission include duplicate billing, insufficient documentation, and false or fraudulent cost reports. Note that the Federal Government is cognizant of the difference between a fraudulent claim and an innocent, erroneous claim. Even though billing errors do not rise to the level of fraud, providers should return payments received for claims submitted in error.

The Federal Government funds grants and programs for services intended to improve the health and well-being of the AI/AN community.  Unfortunately, sometimes the funds intended to provide services are stolen through fraudulent schemes.  Fraud diverts these resources away from the community and into the pockets of wrongdoers.  To ensure that these funds are used for their intended purposes, it is important to know the vulnerabilities that could lead to fraud.  These vulnerabilities include external and internal pressures to commit fraud, the opportunity to commit fraud, and rationalization or a justification of committing fraud.

OIG is at the forefront of the Nation's efforts to fight fraud, waste, and abuse in HHS grants, IHS, and other HHS programs.  OIG does so by 1) preventing, detecting, and deterring fraud, waste, and abuse; 2) fostering sound financial stewardship and reducing improper payments; and 3) holding wrongdoers accountable and recovering misspent public funds.  OIG also undertakes prevention efforts by educating those in the health care industry through the publication of audits, evaluations, and trainings like this one and developing guidance for compliance programs.  

With your help, OIG can increase the detection and prevention of fraud, waste, and abuse to improve the quality, safety, and value of HHS programs.  If you suspect fraud, waste, or abuse, you may report the information that suggests dishonest or illegal activities involving HHS programs.  

• One method of reporting fraud, waste, or abuse is to contact the OIG Hotline.  OIG protects certain current and former HHS employees; HHS employment applicants; and HHS contractors, subcontractors, personal services contractors, grantees, and subgrantees who disclose information to OIG through mechanisms such as the OIG hotline.
• Another method of reporting is to self-disclose if you suspect the law or program requirements have been violated.  OIG’s Health Care Fraud Self-Disclosure Program provides a framework for disclosing, coordinating, evaluating, and resolving potential violations of law.    

Additionally, there are multiple Federal fraud and abuse laws that apply to health care providers.   These laws, such as the False Claims Act (FCA) and the Civil Monetary Penalty Law (CMPL), are generally designed to make sure that the Government is getting what it pays for and that those services are of sufficient quality and are safe.  It is important to understand what conduct violates these laws.

• The FCA allows the Federal Government to recover damages and penalties from persons who knowingly submit, or knowingly cause to be submitted, false or fraudulent claims to the Federal Government, including to Medicare or Medicaid.  It protects the Government from being overcharged, mischarged, or sold shoddy goods or services.  
• The CMPL protects the Government from a variety of improper conduct, including the submission of false claims to HHS grant programs, under contracts, or to Federal health care programs.

Both the FCA and the CMPL are used to address similar improper conduct.  The Department of Justice partners with Federal entities like HHS, OIG, and IHS to bring cases under the FCA in Federal court.  The CMPL is an alternate remedy through which OIG can initiate cases before an HHS administrative law judge.

It is also useful to be aware of the Anti-Kickback Statute (AKS), the Stark Law, and OIG’s Exclusion Authority.

• The AKS is a criminal law that prohibits the knowing and willful exchange, offer to exchange, solicitation, or receipt of anything of value in an effort to influence, induce, or reward the referral of Federal health care program business, including the referral for Medicare, Medicaid, and IHS items and services, and arranging for or recommending such items and services.  
• The Stark Law prohibits physicians from referring Medicare and Medicaid patients for “designated health services” from entities with which the physician or an immediate family member has a financial relationship.  Additionally, the entities are prohibited from presenting or causing to be presented claims to Medicare or Medicaid (or billing another individual, entity, or third-party payer) for those referred services.
• OIG has authority to exclude an individual or entity from participation as a provider or supplier in Federal health care programs, including Medicare, Medicaid, and IHS, among others.  The effect of an OIG exclusion is that no Federal health care program payment may be made for any items or services furnished (1) by an excluded person or (2) at the medical direction or on the prescription of an excluded person.  There are two general types of exclusion.  First are mandatory exclusions that OIG must impose.  Conduct that would result in a mandatory exclusion include criminal convictions relating to Medicare or Medicaid fraud, patient abuse or neglect, and felony convictions related to controlled substances.  The second are permissive exclusions that OIG, in its discretion, may impose.  Conduct that could result in a permissive exclusion include misdemeanor offenses related to health care fraud, misdemeanor offenses related to controlled substances, loss of professional license in certain circumstances, and defaulting on student loans.

OIG Authorities

OIG enforces a variety of Federal laws to prevent or prosecute fraud committed against HHS programs or other misconduct, whether committed by providers, contractors, grantees, or HHS employees.   For your reference, we have listed the most important of these laws in the document below.

OIG's_Statutory_Authorities

246.0 KB

Additional Resources

The document below, Additional Resources for Providers, contains links to resources such as OIG's Fraud Information website.

Additional_Resources_for_Providers

232.1 KB

Additional Trainings

When you complete this training, proceed to one of these courses, found on our website, to increase your knowledge.

Compliance 101:  This training gives an overview of compliance, what it is, why it is important, who is responsible for it, where and when it happens, and how to get started with a compliance program for your organization. If you have not thought about compliance before, this training is a great place to start.

Compliance 201 for Health Care Providers:  This training, specifically for health care providers, goes  into greater depth than Compliance 101.  It focuses on the Seven Fundamentals of Compliance; important Federal fraud and abuse laws; and the remedies available to the Government if an entity commits violations.

Compliance for Governing Boards: This training focuses on the role of Governing Boards in providing compliance oversight. It describes the four actions OIG recommends Governing Boards take to effectively exercise their oversight responsibilities.

Job Aids

These printable job aids are quick references for the topics covered in the course.

The_Fraud_Triangle

299.6 KB

Reporting_to_the_OIG

189.6 KB

OIG_Exclusion_and_Screening_for_Exclusions

183.8 KB

Health_Care_Fraud_Self-Disclosure_Process

293.9 KB

Health_Care_Fraud_Self-Disclosure-Protocol

521.8 KB

Please take the short knowledge check assessment by clicking the link below. After you answer questions about what you've learned, you'll be asked a few questions that can help us improve this course in the future. After you click submit, you'll receive your Certificate of Completion.

CLICK HERE TO ACCESS THE KNOWLEDGE CHECK