Fraud, waste, and abuse

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

The labels do different work

The HHS-OIG fraud-and-abuse overview introduces federal laws that may apply to health care conduct. It does not create one universal FWA test.

Intent, knowledge, materiality, benefit, and program nexus are factual and legal questions. An internal queue should use labels such as potential FWA, payment error, or unresolved concern until the authorized reviewer reaches a supported disposition.

Improper payment is a separate measure

CMS explains that an improper payment may be an overpayment, underpayment, or payment lacking enough documentation to determine correctness. CMS also says improper-payment rates are not fraud-rate estimates. A missing note, coding error, or failed verification may identify a payment problem without proving intent or an unnecessary service.

Keep these questions separate:

• Did the service occur as documented?
• Was it clinically appropriate and within each person's scope?
• Did authorization, benefit, enrollment, and contract requirements apply and clear?
• Did the claim accurately represent provider, code, units, date, place, and service?
• Was payment correct, and does any refund, repayment, appeal, or disclosure route apply?
• What evidence bears on cause, knowledge, recurrence, and control failure?

ABA examples require facts before labels

A duplicated claim caused by a retry defect may begin as an error. Repeated payment after staff knew the retry logic created duplicates raises different questions. A schedule that automatically converts booked time into units can create waste or improper claims when cancellations, travel, supervision, or actual service time are ignored. A copied note, expired authorization, unavailable rendering provider, or service-location mismatch also needs source-level review.

Clinical disagreement deserves its own route. A payer coverage decision does not author the clinician's recommendation, and clinical appropriateness does not establish authorization, correct coding, claim acceptance, or payment. Software can flag a conflict and hold release. It should preserve authorship and leave clinical, billing, compliance, and legal decisions with qualified roles.

Build a neutral intake and response path

Accept concerns from staff, clients, families, contractors, payers, and data controls. Record the allegation or signal, source, date, affected period, claims or services, evidence location, potential safety or payment impact, assigned owner, and preservation hold. Apply confidentiality and non-retaliation protections required by law and policy.

The OIG General Compliance Program Guidance is voluntary and nonbinding. Its seven-element framework includes reporting, investigation, corrective action, auditing, and accountability. A practical response sequence is:

1. protect immediate client safety and required reporting routes.
2. preserve records, system history, communications, and transaction artifacts.
3. stop only the affected release, claim, payment, or workflow when supported by the facts.
4. assign independent clinical, billing, privacy, employment, and legal review as needed.
5. determine the correction, payer contact, refund, repayment, disclosure, discipline, or control change under the governing source.
6. document the disposition, affected population, root cause, validation test, and monitoring period.

The OIG Hotline accepts complaints about potential fraud, waste, abuse, and mismanagement in HHS programs. Its page says every submission does not result in an investigation. A practice should identify the correct payer, state, licensing, law-enforcement, contractual, and counsel route for the event instead of assuming one hotline resolves every duty.

A fictional alert cohort

A fictional ABA practice reviews 30 alerts whose five-business-day review deadline falls in June. Nine are documented false positives, and 21 contain verified source conflicts. Confirmed-conflict yield is 21 of 30, or 70%; that rate describes the control, not misconduct.

Of the 21 conflicts, 13 concern unreleased claims and are corrected before transmission. The remaining eight involve paid claims and enter the payer-specific refund or overpayment disposition process. Compliance sends three of the 21 for privileged legal review because preserved evidence raises questions about possible knowing conduct. The practice does not label those matters fraud from the alert alone.

Measure detection, response, and recurrence

Useful measures include reviewed mature alerts divided by alerts due; confirmed source conflicts divided by reviewed alerts; corrected unreleased claims divided by confirmed unreleased conflicts; paid conflicts with a final refund or repayment disposition divided by paid conflicts due; and repeated conflicts divided by claims exposed to the same rule and workflow version.

Define the alert rule, eligibility date, review window, source, numerator, denominator, exclusions, maturity period, and owner. Show false positives, open matters, aging, dollars under review, client-safety effects, corrective-action completion, and validation results separately. A high alert volume may reflect a sensitive control, a broken workflow, more exposure, or more reporting. It does not establish more fraud.