The lead agency that investigates Medicare provider fraud is the Office of Inspector General at the U.S. Department of Health and Human Services (HHS-OIG). It rarely works alone. The FBI runs parallel investigations, the Department of Justice prosecutes the resulting cases, the Centers for Medicare & Medicaid Services (CMS) freezes payments while investigators dig, state Medicaid Fraud Control Units handle overlapping schemes, and joint Strike Force teams pull all of these players together in the metropolitan areas where fraud clusters.
HHS Office of Inspector General
HHS-OIG exists to root out fraud, waste, and abuse across every program the department oversees, and Medicare is its largest target. The office takes tips through a public hotline from patients, employees, and anonymous sources, and it runs proactive investigations built on billing-data analysis that flags suspicious patterns before anyone files a complaint.1U.S. Department of Health and Human Services Office of Inspector General. Fraud
OIG investigators carry federal law enforcement authority. They issue subpoenas, interview witnesses, review medical records, and sometimes run undercover operations. A single case can take years, especially when the billing scheme spans multiple clinics or crosses state lines. Whatever OIG gathers feeds directly into the criminal and civil cases pursued by the Department of Justice.1U.S. Department of Health and Human Services Office of Inspector General. Fraud
How Cases Reach OIG
Not every investigation starts with a whistleblower. CMS contracts with Unified Program Integrity Contractors, known as UPICs, that comb through Medicare and Medicaid claims data hunting for billing anomalies. When something looks like fraud, the UPIC refers the case to OIG for a full investigation. OIG investigators have credited UPICs with improving the quality of the referrals they receive, making the front-end analytics a meaningful part of how cases enter the pipeline.2Oversight.gov. UPICs Hold Promise to Enhance Program Integrity Across Medicare and Medicaid, But Challenges Remain
The FBI
The FBI describes itself as the primary investigative agency for healthcare fraud targeting both government and private insurance. Its agents bring experience with complex financial crimes, forensic accounting, and long-standing relationships with state and local law enforcement.3Federal Bureau of Investigation. Health Care Fraud
In practice, the FBI and OIG frequently work the same cases side by side, especially through the Strike Force teams. The Bureau also partners with the National Health Care Anti-Fraud Association and private insurer investigative units, which gives it visibility into fraud that crosses between Medicare and commercial coverage.3Federal Bureau of Investigation. Health Care Fraud
The Department of Justice
OIG and the FBI build cases. The Department of Justice takes them to court. DOJ can pursue Medicare fraud through criminal charges, civil actions, or both at the same time, and it recovered over $5.7 billion from healthcare-related settlements and judgments under the False Claims Act in fiscal year 2025 alone.4U.S. Department of Justice. False Claims Act Settlements and Judgments Exceed $6.8B in Fiscal Year 2025
The tools DOJ uses shape the investigations that lead to them. The False Claims Act imposes liability on anyone who knowingly submits false claims to a government program, with treble damages plus a per-claim penalty currently ranging from $14,308 to $28,619 for each false claim.5Office of the Law Revision Counsel. 31 USC 3729 – False Claims The federal healthcare fraud statute carries a maximum 10-year sentence, rising to 20 years if the fraud causes serious bodily injury and up to life if it results in death.6Office of the Law Revision Counsel. 18 USC 1347 – Health Care Fraud The Anti-Kickback Statute makes it a felony to exchange anything of value for referrals involving federal healthcare programs, punishable by up to $100,000 in fines and 10 years in prison per violation.7Office of the Law Revision Counsel. 42 USC 1320a-7b – Criminal Penalties for Acts Involving Federal Health Care Programs The average prison sentence handed down for healthcare fraud in fiscal year 2024 was 27 months, and roughly three-quarters of convicted defendants received prison time.8U.S. Sentencing Commission. Quick Facts on Health Care Fraud Offenses
CMS and the Money Side
CMS runs Medicare, so it doesn’t lead criminal investigations. What it controls is the money, and that gives it a different kind of leverage over providers under investigation.
Payment Suspension
When CMS identifies a credible allegation of fraud, it can suspend payments to the provider while OIG and DOJ investigate. Before imposing a suspension, CMS must consult with OIG and, when appropriate, DOJ. Every 180 days CMS reevaluates whether the suspension should continue and asks law enforcement to certify that the investigation is still active. After 18 months the suspension generally ends unless DOJ specifically requests that it stay in place for a pending or anticipated criminal or civil action.9eCFR. 42 CFR 405.371 – Suspension, Offset, and Recoupment of Medicare Payments to Providers and Suppliers of Services
Enrollment Screening
CMS also tries to prevent fraud at the front door. Providers and suppliers are assigned to risk categories during enrollment, and those in the highest-risk category face fingerprint-based criminal background checks. CMS can deny enrollment or revoke existing billing privileges based on what those checks turn up.
Medicare Fraud Strike Force and HEAT
The most aggressive coordination happens inside the Medicare Fraud Strike Force. These interagency teams bring together OIG, the FBI, DOJ prosecutors, and local law enforcement, and they operate in high-fraud regions including Miami, Los Angeles, Detroit, Houston, Brooklyn, Chicago, and Dallas. Strike Force teams rely on real-time data analytics to catch fraud as it emerges instead of waiting for complaints.10U.S. Department of Health and Human Services Office of Inspector General. Medicare Fraud Strike Force
Speed is the point. Once a Strike Force identifies a suspect, OIG refers the credible allegation to CMS, which suspends payments before the provider can drain more from the program. Some specialized units target particular problems: the Appalachian Regional Strike Force focuses on illegal opioid prescriptions, and a New England counterpart does similar work in the Northeast.10U.S. Department of Health and Human Services Office of Inspector General. Medicare Fraud Strike Force
The Strike Force operates under a broader HHS-OIG and DOJ initiative called HEAT, the Health Care Fraud Prevention and Enforcement Action Team, which coordinates overall federal strategy against healthcare fraud. Strike Force teams are HEAT’s most visible operational arm.11U.S. Department of Justice. Fact Sheet: The Health Care Fraud and Abuse Control Program Protects Consumers and Taxpayers by Combating Health Care Fraud
State Medicaid Fraud Control Units
Federal regulations require every state to run a Medicaid Fraud Control Unit as a single, identifiable entity within state government, and the federal government pays 75 percent of each unit’s operating costs after the first three years.12eCFR. 42 CFR Part 1007 – State Medicaid Fraud Control Units These units investigate and prosecute Medicaid fraud at the state level.
MFCUs matter for Medicare investigations because most large billing schemes hit both programs. A provider running phantom services rarely stops at one payer, and patients enrolled in both Medicare and Medicaid are especially exposed. When an MFCU uncovers fraud affecting dual-eligible patients, the case naturally pulls in OIG and DOJ, and the joint investigation produces a fuller picture of the provider’s conduct across programs.12eCFR. 42 CFR Part 1007 – State Medicaid Fraud Control Units
Reporting Suspected Fraud
Anyone who suspects a Medicare provider of fraud can report it to the HHS-OIG hotline. Useful reports include the provider’s name and contact information, a description of what happened, a timeframe, and any supporting documents such as billing records or emails. OIG will not confirm receipt or share status updates, but every tip is evaluated.13U.S. Department of Health and Human Services Office of Inspector General. Before You Submit a Complaint
Insiders with direct knowledge of fraud have a second option. The False Claims Act lets a whistleblower file a qui tam lawsuit on the government’s behalf and receive a share of the recovery: between 15 and 25 percent when DOJ intervenes, and between 25 and 30 percent when DOJ declines and the whistleblower proceeds alone.14Office of the Law Revision Counsel. 31 USC 3730 – Civil Actions for False Claims Federal law also prohibits employers from firing, demoting, suspending, or otherwise retaliating against employees who report fraud, and those protections reach employees of HHS contractors, subcontractors, and grant recipients, not just direct government workers.15U.S. Department of Health and Human Services Office of Inspector General. Whistleblower Protection Information