The Medicare Integrity Program is the federal effort that funds and directs the fight against fraud, waste, and abuse in Medicare. Congress created it in 1996 as part of the Health Insurance Portability and Accountability Act, giving the Secretary of Health and Human Services authority to contract with specialized entities to audit claims, review provider behavior, recover improper payments, and educate providers and beneficiaries.1Office of the Law Revision Counsel. 42 USC 1395ddd – Medicare Integrity Program By recent estimates, the broader health care fraud enforcement effort it anchors returns about $2.80 for every dollar spent.
Why Congress Created It
The program was established under Section 202(a) of HIPAA (Public Law 104–191), signed into law on August 21, 1996. The statute added Section 1893 to the Social Security Act and gave HHS broad authority to contract with outside entities for program integrity work.1Office of the Law Revision Counsel. 42 USC 1395ddd – Medicare Integrity Program Before this, Medicare had relied on its regular claims-processing contractors to detect fraud, which created an obvious conflict of interest: the same companies paid claims and policed them.
Congress expanded the program significantly through the Medicare Modernization Act of 2003, which launched a demonstration project using Recovery Audit Contractors to identify overpayments and underpayments.2GovInfo. Medicare Prescription Drug, Improvement, and Modernization Act of 2003 The pilot worked well enough that the RAC program became permanent. The Affordable Care Act later added data-matching tools and tighter provider enrollment screening.
Who Actually Does the Work
The Centers for Medicare & Medicaid Services (CMS) oversees the program and delegates day-to-day work to specialized contractors.3eCFR. 42 CFR Part 420 – Program Integrity: Medicare Each contractor type has a distinct role, which matters if you ever receive a records request or an audit notice.
Unified Program Integrity Contractors
Unified Program Integrity Contractors (UPICs) are the primary fraud investigators. They replaced several older contractor types, including Zone Program Integrity Contractors, through a consolidation that wrapped up around 2017, and they now operate across five geographic regions covering the entire country.4CMS. Resources for State and Territory Program Integrity Directory When a UPIC identifies suspicious billing, it can request medical records, conduct on-site visits, interview staff, and build cases for administrative action or referral to law enforcement. UPICs handle both Medicare and Medicaid integrity work, so a single investigation can span both programs.
Medicare Administrative Contractors
Medicare Administrative Contractors (MACs) are private insurers awarded regional jurisdictions to process Medicare Part A and Part B claims. Their core work includes paying claims, enrolling providers, and handling the first level of appeals.5CMS. What’s a MAC MACs also conduct medical review on selected claims to confirm that billed services are covered, correctly coded, and medically necessary. They aren’t fraud investigators in the way UPICs are, but their claim-level reviews catch a substantial volume of billing errors.
Recovery Audit Contractors
Recovery Audit Contractors (RACs) look for improper payments after claims have already been paid. They review claims data to identify both overpayments and underpayments, then initiate corrections.6eCFR. 42 CFR Part 455 Subpart F – Medicaid Recovery Audit Contractors Program RACs are paid on a contingency-fee basis, earning a percentage of the improper payments they identify. That incentive has drawn criticism from providers who feel it encourages overly aggressive auditing, but it also means RACs are highly motivated to find genuine errors.
Law Enforcement Partners
CMS doesn’t work in isolation. When investigations uncover potential criminal conduct, cases get referred to the HHS Office of Inspector General (OIG) and the Department of Justice. DOJ Health Care Fraud Strike Force teams operate in cities with high levels of billing fraud, using data analysis to spot aberrant patterns and then deploying investigators and prosecutors to build criminal cases.7DOJ. Strike Force Operations
Fraud, Waste, and Abuse Are Not the Same Thing
These three categories sound similar but carry very different legal weight, and the distinction determines what kind of consequences a provider faces.
Fraud requires intent. Someone knowingly bills for services never provided, submits false diagnoses to justify unneeded procedures, or upcodes claims to charge for a more expensive service than what was performed. Fraud triggers criminal prosecution and the harshest penalties.
Waste involves careless overuse of resources that drives up Medicare costs without deliberate deception. Ordering redundant lab tests or prescribing brand-name drugs when generics would work is a common example. Waste usually leads to education and corrective action rather than prosecution.
Abuse sits between the two. It involves billing practices that don’t meet accepted medical or business standards, like routinely billing for the most expensive version of an office visit when the documentation doesn’t support it. Abuse may not involve deliberate deception, but it still costs Medicare money and can trigger civil penalties.
How the Program Works in Practice
The program uses a layered approach that starts with data and ends with enforcement. Each layer catches different problems.
Data Analysis
CMS and its contractors run Medicare claims through algorithms looking for statistical outliers: providers billing far above their peers, unusual geographic patterns, or sudden spikes in specific procedure codes. The Medicare-Medicaid Data Match Program (commonly called “Medi-Medi”) cross-references claims across both programs to spot providers exploiting gaps between the two.1Office of the Law Revision Counsel. 42 USC 1395ddd – Medicare Integrity Program Most investigations begin here.
Pre-Payment and Post-Payment Review
Claims reviews happen on both sides of the payment decision. In pre-payment review, a MAC examines selected claims before authorizing payment, and providers with a history of billing problems may see a portion of their claims held until they demonstrate corrected practices. Post-payment reviews, often conducted through statistically valid sampling, estimate whether overpayments or underpayments exist across a provider’s claims without requiring records on every single claim.8CMS. Medicare Claim Review Programs
Provider Enrollment Screening
One of the program’s most effective tools is preventing bad actors from entering Medicare at all. CMS assigns every provider and supplier type to one of three risk categories (limited, moderate, or high) and applies escalating screening requirements to each.9eCFR. 42 CFR 424.518 – Screening Levels for Medicare Providers and Suppliers Limited-risk providers face license verification and database checks. Moderate-risk providers also get unannounced site visits. High-risk categories, which include newly enrolling home health agencies and durable medical equipment suppliers, must submit fingerprints for criminal background checks.
Payment Suspension
When CMS determines that a credible allegation of fraud exists against a provider, it can suspend Medicare payments in whole or in part. Before doing so, CMS must consult with the OIG and, where appropriate, DOJ.10eCFR. 42 CFR 405.371 – Suspension, Offset, and Recoupment of Medicare Payments CMS reviews each suspension every 180 days and must lift it after 18 months if the investigation hasn’t been resolved, unless DOJ requests an extension because criminal or civil action is pending. Suspensions hit a provider’s cash flow before any final determination of wrongdoing, which makes them a powerful lever.
Education
Not everything the program does is punitive. The statute authorizes education for providers, beneficiaries, and other stakeholders on payment integrity and benefit quality.1Office of the Law Revision Counsel. 42 USC 1395ddd – Medicare Integrity Program CMS publishes billing guidance, hosts webinars through the Medicare Learning Network, and issues targeted alerts when new fraud schemes emerge. For many providers, a compliance education session after a billing error is the only interaction they’ll ever have with the program.
What Happens to Providers Who Get Caught
Consequences range from fines to decades in prison, depending on the severity of the conduct.
Federal law makes it a felony to submit false statements or claims to Medicare. A provider who furnishes items or services based on false information faces fines up to $100,000 and up to 10 years in prison per offense.11Office of the Law Revision Counsel. 42 USC 1320a-7b – Criminal Penalties for Acts Involving Federal Health Care Programs Kickback violations, meaning paying or receiving anything of value in exchange for referrals of Medicare patients, carry the same maximums. If a fraud scheme results in serious bodily injury, the maximum prison sentence jumps to 20 years. If a patient dies as a result, a life sentence is possible under the general federal health care fraud statute.
Civil penalties apply even without criminal prosecution. Under OIG authority, knowingly presenting a false claim to Medicare can result in a penalty of up to $25,595 per item or service, based on the most recent inflation adjustment.12Federal Register. Annual Civil Monetary Penalties Inflation Adjustment The False Claims Act allows the government to pursue additional per-claim penalties plus triple the damages the government sustained.
The most career-ending consequence is exclusion from all federal healthcare programs. Once OIG places a provider on the List of Excluded Individuals and Entities, no federal program will pay for any item or service that provider furnishes, directs, or prescribes. The ban extends to salary and fringe benefits: an employer who hires an excluded individual and bills Medicare for their work faces penalties of up to $10,000 per item or service, plus triple damages and potential exclusion of the employer. Reinstatement is not automatic.13HHS OIG. The Effect of Exclusion From Participation in Federal Health Care Programs
Providers who disagree with an overpayment determination can challenge it through Medicare’s five-level appeals process, which begins with a MAC redetermination and can end in federal district court.14CMS. Medicare Overpayments Fact Sheet Missing a filing deadline at any level generally forfeits the right to keep appealing.
How to Report Suspected Fraud
Anyone can report suspected Medicare fraud. The HHS Office of Inspector General runs a hotline for tips about fraud, waste, and abuse in HHS programs. You can file a complaint online at the OIG website or call 1-800-HHS-TIPS (1-800-447-8477).15HHS OIG. Submit a Hotline Complaint
CMS also pays monetary rewards for information leading to the recovery of at least $100 in Medicare funds from individuals or entities engaged in fraud or abuse, with the amount left to CMS’s discretion.3eCFR. 42 CFR Part 420 – Program Integrity: Medicare For larger-scale fraud, the False Claims Act allows private citizens to file “qui tam” lawsuits on behalf of the government.16DOJ. The False Claims Act Whistleblowers who bring successful qui tam cases typically receive between 15% and 30% of the government’s recovery, depending on whether the government joins the case.
If you’re a Medicare beneficiary, the simplest thing you can do is read your Medicare Summary Notices. Look for services you never received, equipment you didn’t order, duplicate charges, and providers you’ve never visited. The Senior Medicare Patrol program, funded through the Administration for Community Living, trains volunteers to help beneficiaries spot and report potential fraud, and every state has one.17ACL. Senior Medicare Patrol (SMP) If something on your statement doesn’t look right, that’s the place to start.