Medicaid Fraud, Waste, and Abuse: Penalties and Whistleblowers

Medicaid fraud, waste, and abuse are three distinct categories of misconduct with three different legal responses: fraud is intentional deception to obtain benefits or payments, waste is unnecessary spending that reflects poor management rather than dishonesty, and abuse covers billing practices and behaviors that fall short of professional standards without meeting the strict intent requirement for fraud. Federal enforcement layers civil fines, criminal prosecution, and program exclusion on top of one another, so a single scheme can trigger all three at once. In fiscal year 2025, the Centers for Medicare & Medicaid Services estimated the Medicaid improper payment rate at 6.12%, roughly $37.39 billion in payments that should not have been made or were made in the wrong amount.¹

How the Three Categories Are Defined

Fraud requires intent. A person commits Medicaid fraud when they deliberately deceive the program to obtain money or benefits they are not entitled to. The defining ingredient is knowledge: the person knows the claim, application, or representation is false, and submits it anyway to gain a financial advantage.²

Waste involves unnecessary spending that does not rise to criminal behavior. Duplicative lab tests ordered because of a sloppy office workflow cost the program money without anyone scheming to profit. Waste generally reflects poor management.²

Abuse sits between the two. It covers provider billing practices that fall outside professionally recognized standards and lead the program to pay for services that are not medically necessary. It also covers beneficiary behavior that generates unnecessary costs. The line between abuse and fraud usually comes down to whether the person acted with a deliberate plan to deceive or engaged in self-serving practices without that specific intent.³

Where Honest Mistakes End and Liability Begins

A single miscoded claim is not fraud. Medical billing is complicated, staff make data entry mistakes, and wrong codes slip through. Investigators look for patterns. A provider who accidentally enters an incorrect procedure code on one claim has made a billing error. A provider who systematically bills a higher-paying code across hundreds of claims has created a pattern that eliminates the honest-mistake defense.

The False Claims Act does not require prosecutors to prove criminal intent for civil liability. Acting with reckless disregard for whether a claim is accurate is enough.⁴ A provider who never audits billing staff or checks whether claims are accurate can still face treble damages. Healthcare organizations that lack internal compliance checks carry legal exposure whether they intended to cheat or not.

Common Schemes That Trigger Enforcement

Certain schemes appear repeatedly in enforcement actions. Recognizing them helps beneficiaries spot problems on their own statements and helps providers understand what auditors are looking for.

Phantom billing: submitting claims for office visits, medical equipment, or prescriptions the patient never received. This is the most direct form of fraud and one of the easiest to detect from a statement.⁵
Upcoding: billing for a more expensive service than the one actually performed. A brief check-up billed as a comprehensive evaluation is upcoding.⁶
Unbundling: billing each component of a single procedure separately rather than using the correct bundled code, because the components add up to more than the bundled code pays.
Medically unnecessary services: ordering excessive tests, imaging, or therapy sessions purely to generate billing volume.
Identity sharing: a beneficiary lending their Medicaid card to an uninsured friend or relative so that person can receive care under the beneficiary’s coverage.
Eligibility fraud: providing false income or household information on a Medicaid application to qualify for benefits the person would not otherwise receive.

Kickbacks and Referral Schemes

The Anti-Kickback Statute makes it a felony to offer or receive anything of value in exchange for patient referrals to a service covered by a federal healthcare program.⁷ The classic example is a specialist paying a primary care doctor a fee for every patient sent over, but the law reaches any form of compensation tied to referrals: gift cards, free rent, luxury dinners.

Not every financial relationship between healthcare entities is illegal. Federal regulations create “safe harbors” that protect legitimate business arrangements, including fair-market-value lease agreements, standard employee compensation, bona fide investment returns, personal services contracts, and group purchasing arrangements.⁸ The common thread is that payment must reflect fair market value and cannot be tied to referral volume. A lease that charges more rent when more patients are referred fails that test.

Penalties for Providers

Federal enforcement runs on parallel tracks. The same conduct can produce civil fines, a criminal case, and exclusion from federal health programs simultaneously.

Civil Fines

Under the Civil Monetary Penalties Law, the government can impose fines of up to $20,000 for each false claim submitted, plus an assessment of up to three times the amount fraudulently claimed.⁹ For a provider who submits hundreds of inflated claims, these per-item penalties compound quickly.

The False Claims Act separately allows the government to recover three times its actual damages, plus a per-violation civil penalty. For 2025, that per-violation penalty ranges from $14,308 to $28,619, adjusted annually for inflation.¹⁰ A moderately sized scheme involving a few hundred false claims can produce liability in the millions.

Prison Time

The federal health care fraud statute carries up to 10 years in prison. If the fraud results in serious bodily injury, that ceiling rises to 20 years. If someone dies, the sentence can be life imprisonment.¹¹ Anti-Kickback violations are separately punishable by up to $100,000 in fines and up to 10 years in prison per offense.⁷

Exclusion From Federal Programs

Exclusion is often the penalty that ends careers. When the Office of Inspector General places a provider on the exclusion list, that individual or entity cannot receive payment from Medicare, Medicaid, or any other federally funded health program for any services they furnish, order, or prescribe.¹²

For a felony conviction related to healthcare fraud, exclusion is mandatory for a minimum of five years. A second conviction extends the minimum to 10 years, and a third results in permanent exclusion.¹³ Because most healthcare providers depend heavily on federal reimbursements, even a five-year exclusion can effectively shut down a practice.

Organizations settling civil fraud cases often avoid exclusion by entering a Corporate Integrity Agreement with the OIG. These agreements typically last five years and require a dedicated compliance officer, new written policies, workforce training, and an independent review organization auditing billing annually.¹⁴

Penalties for Beneficiaries

Providers are not the only ones who face consequences. Beneficiaries who commit Medicaid fraud by faking eligibility, lending their cards, or helping stage fictitious claims can be prosecuted under the same federal statutes. A conviction can bring prison time, fines, and court-ordered restitution requiring repayment of every dollar received fraudulently. Losing Medicaid eligibility is a common administrative outcome, which can be devastating for someone who genuinely needs coverage going forward.

Whistleblowers and Qui Tam Lawsuits

Many Medicaid fraud cases begin with an insider. The False Claims Act allows any person with evidence of false claims to file a lawsuit on the government’s behalf. The complaint is filed under seal for at least 60 days, during which the defendant is not notified, and the government reviews the evidence and decides whether to take over the case.¹⁵

The financial incentive is substantial. If the government intervenes and prosecutes, the whistleblower receives between 15% and 25% of the recovery. If the government declines and the whistleblower proceeds alone, the share rises to 25% to 30%.¹⁵

The law also protects whistleblowers from retaliation. An employee who is fired, demoted, suspended, or harassed for reporting fraud can sue for reinstatement, double back pay, interest, and compensation for special damages including attorney fees. A retaliation claim must be filed within three years of when the retaliation occurred.¹⁵

How to Report Suspected Violations

You do not need a lawyer or a qui tam lawsuit to report Medicaid fraud. A useful report includes the full name and business address of the provider or beneficiary involved, the dates of the suspicious activity, and a clear description of what happened. If you have the provider’s Medicaid billing number or the beneficiary’s identification number, include it. The strongest supporting evidence usually comes from documents you already have: billing statements, explanations of benefits, or medical records showing a mismatch between what was billed and what actually happened.

The HHS Office of Inspector General runs a hotline that accepts tips about fraud, waste, abuse, and mismanagement in any federal health program. Reports can be submitted online, by phone, or by mail.¹⁶ State-level Medicaid Fraud Control Units operate in all 50 states, the District of Columbia, Puerto Rico, and the U.S. Virgin Islands, investigating provider fraud and also handling cases involving abuse or neglect of patients in healthcare facilities.¹⁷ Filing with your state’s unit often means faster action on cases involving local providers.

The 60-Day Repayment Rule for Providers

Providers who discover a Medicaid overpayment face a hard deadline. Federal law requires them to report and return the overpayment within 60 days of identifying it.¹⁸ Missing that window converts the overpayment into a potential false claim, exposing the provider to treble damages and per-claim penalties under the False Claims Act. The clock starts when the provider has actual knowledge of the overpayment, deliberately ignores evidence of it, or acts with reckless disregard for the truth.

The OIG’s Provider Self-Disclosure Protocol offers a structured path for entities that discover they may have submitted false claims. Self-disclosing avoids the cost of a full government investigation, and the OIG generally views voluntary disclosure favorably when calculating penalties.¹⁹ Discovering a billing problem and doing nothing about it is one of the worst choices a provider can make: the 60-day rule means silence becomes liability, and the cost of keeping an overpayment you know about is far steeper than returning it.

1
Centers for Medicare & Medicaid Services. Fiscal Year 2025 Improper Payments Fact Sheet
2
eCFR. 42 CFR 455.2 – Definitions
3
eCFR. 42 CFR 455.2 – Definitions
4
Department of Justice. The False Claims Act
5
Federal Bureau of Investigation. Healthcare Fraud
6
Centers for Medicare & Medicaid Services. Medicare Fraud and Abuse – Prevent, Detect, Report
7
Office of the Law Revision Counsel. 42 USC 1320a-7b – Criminal Penalties for Acts Involving Federal Health Care Programs
8
eCFR. 42 CFR 1001.952 – Exceptions
9
Social Security Administration. 42 USC 1320a-7a – Civil Monetary Penalties
10
Federal Register. Civil Monetary Penalties Inflation Adjustments for 2025
11
Office of the Law Revision Counsel. 18 USC 1347 – Health Care Fraud
12
Office of Inspector General. Exclusions Program
13
Office of Inspector General. Background Information and Exclusion Authorities
14
Office of Inspector General. Corporate Integrity Agreements
15
Office of the Law Revision Counsel. 31 USC 3730 – Civil Actions for False Claims
16
Office of Inspector General. Submit a Hotline Complaint
17
Office of Inspector General. Medicaid Fraud Control Units
18
Office of the Law Revision Counsel. 42 USC 1320a-7k – Medicare and Medicaid Program Integrity Provisions
19
Office of Inspector General. Health Care Fraud Self-Disclosure