Medicaid Fraud, Waste, and Abuse: Rules and Consequences

Medicaid fraud, waste, and abuse collectively drain billions of dollars annually from a program that serves more than 90 million low-income Americans, according to CMS enrollment data. Federal and state laws establish distinct definitions for each category, assign specific enforcement mechanisms, and impose consequences ranging from repayment obligations to criminal prosecution. This page explains how regulators distinguish fraud from waste and abuse, what conduct triggers liability, and where the legal boundaries lie across the most common scenarios.

Definition and scope

The U.S. Department of Health and Human Services Office of Inspector General (HHS-OIG) and the Centers for Medicare & Medicaid Services (CMS) operate under a framework that separates three distinct categories of improper conduct, each carrying different legal standards and consequences.

Fraud requires intentional deception or misrepresentation made knowingly to obtain an unauthorized Medicaid benefit or payment. The primary federal statute is the False Claims Act (31 U.S.C. §§ 3729–3733), which imposes civil penalties between $13,946 and $27,894 per false claim (figures adjusted for inflation under Federal Civil Penalties Inflation Adjustment Act) plus treble damages on top of the improperly obtained amount.

Waste refers to overutilization or underutilization of services, or other practices that result in unnecessary costs to Medicaid, without evidence of intentional deception. Waste does not carry criminal liability but can trigger recoupment demands and compliance corrective action plans.

Abuse involves practices inconsistent with sound fiscal, business, or medical practices that result in unnecessary costs or reimbursement for services that are not medically necessary — again, without the intent element required for fraud. Abuse findings can escalate to fraud investigations if a pattern of conduct suggests knowledge.

The key dimensions and scopes of Medicaid — including the split between federal and state funding under the Federal Medical Assistance Percentage (FMAP) formula — explain why both levels of government share enforcement authority. Each state operates a Medicaid Fraud Control Unit (MFCU) certified by HHS-OIG, and 42 U.S.C. § 1396b(q) sets the federal match rate for MFCUs at 90 percent of operating costs in the first 3 years.

How it works

Enforcement operates through 4 primary channels:

1. Administrative action — CMS or a state Medicaid agency recoups overpayments, imposes payment suspensions, or terminates provider agreements under 42 C.F.R. Part 455.
2. Civil litigation — The Department of Justice (DOJ) or a qui tam relator (whistleblower) files suit under the False Claims Act. Qui tam relators may receive between 15 and 30 percent of the government's recovery, as specified in 31 U.S.C. § 3730(d).
3. Criminal prosecution — Knowing and willful false statements to obtain Medicaid payment are prosecuted under 18 U.S.C. § 1347 (health care fraud statute), carrying up to 10 years imprisonment per count, or up to 20 years if serious bodily injury results.
4. Exclusion from federal programs — HHS-OIG holds authority under 42 U.S.C. § 1320a-7 to exclude individuals and entities from all federal health care programs. Exclusion is mandatory for convictions related to patient abuse or felony health care fraud, and permissive for a range of lesser violations.

Referrals originate from state MFCUs, CMS audit contractors, HHS-OIG data analysts, and whistleblowers. CMS deploys Unified Program Integrity Contractors (UPICs) to detect anomalous billing patterns before payment is issued — a "pay and chase" reduction strategy mandated by the Affordable Care Act (ACA), Section 6402.

Common scenarios

Enforcement records from HHS-OIG identify recurring conduct patterns across provider types:

• Billing for services not rendered — A provider submits claims for patient encounters that never occurred. This is a clear fraud scenario with criminal exposure.
• Upcoding — A provider bills a higher-complexity evaluation-and-management code than the documented encounter supports. Upcoding is the most litigated category in False Claims Act settlements involving physician practices.
• Unbundling — Billing component procedures separately when a single bundled code is required, inflating reimbursement artificially.
• Kickbacks — Paying or receiving remuneration in exchange for patient referrals violates the Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)), a felony with penalties up to $100,000 per act and 10 years imprisonment per count.
• Duplicate billing — Submitting the same claim to Medicaid more than once, or to both Medicaid and Medicare simultaneously for the same service.
• Medically unnecessary services — Ordering or providing services that lack clinical justification, a common abuse finding in home health, durable medical equipment, and behavioral health billing.

Decision boundaries

Distinguishing fraud from waste or abuse is rarely straightforward and hinges on 3 factors: knowledge, intent, and pattern.

The False Claims Act's "deliberate ignorance" standard — established under 31 U.S.C. § 3729(b)(1)(A) — means a provider cannot avoid liability by deliberately avoiding knowledge of billing irregularities. A compliance officer who ignores persistent upcoding alerts faces the same legal exposure as one who actively directs the conduct.

The Medicaid Frequently Asked Questions resource addresses how beneficiaries can report suspected fraud through the HHS-OIG Hotline, which received more than 150,000 contacts annually in recent reporting periods according to HHS-OIG annual reports.

For those navigating Medicaid coverage questions or accessing program support, the how to get help for Medicaid page provides structured guidance on state agency contacts and eligibility resources.

The central Medicaid Authority resource covers the full regulatory architecture of the program, including enforcement agency roles and beneficiary protections that intersect with fraud prevention obligations.