What Should Healthcare Fraud, Waste, and Abuse Training Include? A Guide for Medical and Behavioral Health Providers

Healthcare fraud, waste, and abuse (FWA) training is an important component of an effective healthcare compliance program. However, simply explaining the False Claims Act, Anti-Kickback Statute, and penalties associated with healthcare fraud may not adequately prepare employees to recognize compliance risks in their day-to-day responsibilities.

For physicians, nurses, behavioral-health professionals, billing specialists, administrative personnel, and supervisors, effective FWA training should connect federal and state compliance requirements to the decisions employees actually make.

Healthcare fraud, waste, and abuse training should teach employees how to recognize improper billing, inaccurate documentation, medically unnecessary services, prohibited referral arrangements, and other compliance concerns—and explain how to report suspected misconduct.

The U.S. Department of Health and Human Services Office of Inspector General (HHS-OIG) identifies training and education as one of the seven fundamental elements of an effective healthcare compliance program. Its General Compliance Program Guidance recommends that organizations develop education and training programs appropriate to their particular operations, risks, and workforce responsibilities (HHS-OIG, General Compliance Program Guidance).

For healthcare employers, the question is not simply whether employees have completed FWA training. It is whether that training prepares them to recognize and appropriately respond to the risks their organization actually encounters.

Recent federal enforcement actions demonstrate why healthcare organizations should regularly evaluate their compliance education programs. Evolve’s analysis of Medicare fraud, waste, and abuse in 2026 examines major enforcement developments and what they mean for employee training.

What Is Healthcare Fraud, Waste, and Abuse?

Before employees can recognize potential compliance violations, they need to understand the differences between fraud, waste, and abuse. Although these terms are frequently grouped together, they are not interchangeable.

Healthcare Fraud

Healthcare fraud generally involves knowingly submitting false or fraudulent information to obtain payment or another benefit. Examples include billing Medicare or Medicaid for services that were never provided, deliberately falsifying clinical documentation, or knowingly submitting claims that misrepresent the services performed. Under the federal False Claims Act, knowledge can include actual knowledge, deliberate ignorance, or reckless disregard of whether information is true or false. Specific intent to defraud is not required for civil False Claims Act liability.

Healthcare Waste

Waste generally involves the unnecessary or inefficient use of healthcare resources. Examples may include ordering duplicative diagnostic testing without a clinical justification or consistently using unnecessarily expensive resources when an appropriate, less costly alternative is available.

Healthcare Abuse

Abuse generally involves practices inconsistent with accepted medical, business, or fiscal practices that may create unnecessary costs or result in improper payments. Examples may include excessive billing, unnecessary services, or practices that do not satisfy applicable reimbursement requirements.

Not every billing error or improper payment is fraud.

CMS expressly distinguishes improper-payment estimates from fraud estimates because many improper payments arise from documentation deficiencies, administrative errors, or insufficient information rather than intentional deception (CMS, “Fiscal Year 2025 Improper Payments Fact Sheet”). Understanding these distinctions helps employees recognize potential problems without assuming every error represents criminal conduct.

---

What Topics Should Healthcare Fraud, Waste, and Abuse Training Cover?

A comprehensive FWA training program should establish a common foundation for employees while addressing the specific risks associated with their roles and healthcare setting. The following subjects provide a practical framework.

1. Federal Healthcare Fraud and Abuse Laws

Employees should understand the principal federal laws designed to protect Medicare, Medicaid, and other federal healthcare programs. These include:

• False Claims Act (31 U.S.C. §§ 3729–3733): Addresses knowingly submitting or causing the submission of false or fraudulent claims for government payment.
• Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)): Prohibits knowingly and willfully offering, paying, soliciting, or receiving remuneration to induce or reward referrals or business involving items or services payable by federal healthcare programs.
• Physician Self-Referral Law, or Stark Law (42 U.S.C. § 1395nn): Generally restricts physicians from referring patients for designated health services payable by Medicare to entities with which they or immediate family members have financial relationships, unless an exception applies. The law also has Medicaid implications.
• Exclusion Authorities (42 U.S.C. § 1320a-7): Address circumstances under which individuals or organizations may be excluded from participating in federal healthcare programs.
• Civil Monetary Penalties Law (42 U.S.C. § 1320a-7a): Authorizes administrative penalties for specified healthcare misconduct.

HHS-OIG identifies these as five principal federal fraud and abuse laws applicable to physicians. Its Fraud & Abuse Laws resource explains their operation and provides examples of potential violations involving healthcare billing, referrals, financial relationships, and provider participation.

Training should focus on helping employees recognize situations that may implicate these laws rather than expecting every employee to become an expert in healthcare fraud litigation. For example, a physician should recognize that accepting compensation for referrals may raise Anti-Kickback Statute concerns, while a billing employee should understand why knowingly submitting an inaccurate claim creates False Claims Act risk.

2. Medical Necessity and Appropriate Service Delivery

Healthcare employees should understand that reimbursement requirements and medical necessity are central to proper billing. Providing a service does not automatically mean the service is covered or separately reimbursable. For general healthcare organizations, relevant examples include:

• Ordering unnecessary laboratory tests.
• Billing for visits that did not occur.
• Providing services without required orders.
• Billing for procedures that do not satisfy coverage criteria.
• Submitting claims for services already included in another payment.
• Continuing treatment primarily to generate reimbursement rather than based on clinical need.

For behavioral-health providers, examples may include unnecessary therapy sessions, services outside an approved treatment plan, or billing for treatment that was not actually performed. A useful employee-training scenario might involve a patient who has completed a treatment plan, but management directs staff to continue scheduling visits primarily to maintain revenue. The learner should understand that financial considerations do not replace clinical judgment or applicable coverage requirements.

3. Accurate Clinical Documentation

Documentation integrity is one of the most important subjects in healthcare FWA training because the medical record frequently serves as the foundation for the resulting claim.

CMS’s Documentation Matters Toolkit emphasizes that medical professionals are responsible for documenting patient encounters completely, accurately, and promptly. CMS provides separate educational resources for medical professionals, behavioral-health practitioners, and medical-office personnel, recognizing that documentation responsibilities vary by role (CMS, “Documentation Matters Toolkit”). Training should address:

• Documenting services actually performed.
• Recording accurate encounter dates and durations.
• Supporting medical necessity.
• Identifying the individual who performed the service.
• Avoiding fabricated or misleading records.
• Correcting documentation errors appropriately.
• Understanding electronic health record responsibilities.

Behavioral Health Example: Inflated Encounter Duration

On September 17, 2026, a Maryland registered nurse pleaded guilty to participating in a $14 million D.C. Medicaid fraud conspiracy involving mental-health services that were never provided or were grossly inflated. According to DOJ, the conduct included billing a full hour for brief telephone encounters and reusing information from one telehealth session to support multiple fabricated encounter notes. The nurse also had supervisory responsibilities that included reviewing encounter documentation (U.S. Attorney’s Office, District of Columbia).

This case provides a practical example of why employees must understand that clinical records should reflect actual services—not the maximum time that can be billed.

For general healthcare providers, the same principle applies to office visits, diagnostic procedures, treatment sessions, rehabilitation services, and other reimbursable encounters.

For a closer examination of the September 17 guilty plea and other recent enforcement actions, read our analysis of behavioral health Medicaid fraud and the compliance training lessons from a $14 million case.

4. Billing and Coding Integrity

FWA training should help employees recognize that errors in billing and coding can create compliance exposure even when a legitimate healthcare service occurred. General healthcare examples include:

• Upcoding services.
• Unbundling procedures.
• Billing for services already included in another payment.
• Duplicate claims.
• Billing under an incorrect provider.
• Misrepresenting the location of service.
• Submitting claims inconsistent with the medical record.
• Billing for services that do not satisfy applicable coverage requirements.

Employees do not necessarily need to become certified coders. However, they should understand that reimbursement depends on accurate information. A front-office employee who notices an incorrect service date or a nurse who is instructed to document a procedure that was never performed should know how to report the discrepancy. For organizations with complex billing operations, additional training may be appropriate for billing specialists, coders, clinical documentation personnel, and supervisors.

5. Provider Qualifications, Credentials, and Exclusion Screening

Another important training subject is ensuring that the individual identified in the claim is authorized and qualified to provide the billed service. This includes:

• Professional licensure.
• Scope of practice.
• Applicable supervision requirements.
• Provider enrollment.
• National Provider Identifier use.
• Employee and contractor qualifications.
• Exclusion screening.

These issues can be particularly important in behavioral health, where reimbursement may differ depending on the qualifications of the clinician providing a service. In July 2026, Addiction Recovery Care and affiliated organizations agreed to a civil judgment exceeding $16.2 million to resolve allegations involving Kentucky Medicaid billing. The government alleged that some behavioral-health services were furnished by lower-level healthcare workers but billed as though they were performed by employees with higher-level licenses. The resolution involved allegations, not a judicial determination of liability (U.S. Attorney’s Office, Eastern District of Kentucky).

For physician practices and general healthcare providers, comparable risks may involve billing under the wrong practitioner, inadequate supervision, or employing excluded individuals in federally reimbursed services. Training should explain why accurate credentialing and proper provider identification matter to both patient care and reimbursement.

6. Referral Relationships, Kickbacks, and Financial Incentives

Healthcare employees should recognize that compensation arrangements and referral incentives can create compliance concerns even when legitimate healthcare services are provided. Examples include:

• Payments for patient referrals.
• Improper gifts or incentives.
• Compensation tied to generating orders.
• Questionable medical-director arrangements.
• Unusual vendor payments.
• Financial relationships that influence clinical decisions.

These risks are not limited to physicians. Marketing personnel, business-development teams, administrators, executives, and employees involved in vendor relationships may encounter arrangements that warrant compliance review. Training should explain when employees should involve management, legal counsel, or the compliance department before entering into or continuing an arrangement.

7. Reporting Suspected Fraud, Waste, and Abuse

Recognizing a potential problem is only useful if employees know what to do next. An effective FWA course should clearly explain:

• What conduct should be reported.
• How employees can report concerns.
• Who receives the report.
• Whether anonymous reporting is available.
• How confidentiality is handled.
• The organization’s nonretaliation policy.
• What happens after a concern is reported.

Employees should understand that they are not expected to conduct their own investigations or prove that fraud occurred before reporting a good-faith concern. For example, a medical assistant who believes documentation has been altered should know how to raise the issue without confronting colleagues or independently accessing unrelated patient records. HHS-OIG identifies effective communication, internal monitoring, corrective action, and enforcement of compliance standards as fundamental components of a healthcare compliance program (HHS-OIG, General Compliance Program Guidance).

---

Why Should Healthcare FWA Training Be Tailored to Employee Roles?

The central weakness of a one-size-fits-all approach is that healthcare employees encounter different compliance risks. A physician, billing specialist, clinical supervisor, and administrative assistant do not have identical responsibilities. They should share foundational compliance knowledge, but training becomes more practical when it explains how that knowledge applies to their work.

General Healthcare and Physician Practices

For medical practices, urgent care centers, outpatient clinics, and specialty practices, training should emphasize:

• Medical necessity.
• Accurate coding and billing.
• Documentation integrity.
• Physician orders.
• Referral relationships.
• Provider qualifications.
• Claims corrections.
• Employee reporting.

For example, a physician may need more detailed instruction on financial relationships and medical necessity, while a billing employee may require additional training on claims accuracy and escalation procedures.

Behavioral Health and Substance Use Disorder Providers

Behavioral-health organizations frequently encounter additional risks involving the way treatment services are documented and reimbursed. Training should address:

• Actual encounter duration.
• Individual versus group services.
• Telebehavioral-health documentation.
• Treatment plans.
• Community-support services.
• Provider credentials.
• Patient status and service availability.
• Supervisory review.
• Referral and patient-recruitment practices.

Behavioral-health providers should also receive separate instruction on applicable privacy requirements, including HIPAA Privacy and Security training and 42 CFR Part 2 when their operations involve protected substance-use-disorder records.

Hospitals and Health Systems

Hospitals may need additional training involving:

• Medical necessity and level of care.
• Physician relationships.
• Discharge planning.
• Billing and revenue-cycle integrity.
• Clinical documentation.
• Contractor oversight.
• Department-level compliance reporting.

Managers and Supervisors

Managers should understand how to recognize organizational risks that individual employees may not see. Examples include repeated documentation across patients, unusual productivity patterns, unexplained increases in billed services, or employees reporting pressure to alter records. A supervisor’s training should address how to respond appropriately to a concern, preserve relevant information, avoid retaliation, and escalate suspected misconduct.

Recommended Training by Employee Role:

---

Is Fraud, Waste, and Abuse Training Required for Healthcare Employees?

The answer depends on the organization’s operations, participation in federal healthcare programs, state requirements, and applicable payer contracts.

There is no single federal requirement that every employee of every healthcare provider complete the same annual FWA course. However, certain healthcare programs expressly mandate compliance training for specified personnel, including annual training requirements.

Healthcare organizations should distinguish between mandatory federal regulations, voluntary compliance guidance, and contractual requirements.

HHS-OIG General Compliance Program Guidance

HHS-OIG’s General Compliance Program Guidance, published in November 2023, identifies education and training as one of the seven fundamental elements of an effective compliance program. OIG recommends that healthcare organizations develop an annual training plan identifying the topics to be covered and the intended audience for each topic. The guidance also recommends that applicable board members, officers, employees, contractors, and medical staff receive training at least annually on the organization’s compliance program and potential compliance risks.

However, OIG’s General Compliance Program Guidance is voluntary and does not independently establish a universal annual FWA training mandate for every healthcare employer (HHS-OIG, General Compliance Program Guidance). Organizations should nevertheless consider the guidance when developing or evaluating their compliance education programs.

Medicare Advantage and Part D: Mandatory Annual Compliance Training

Medicare Advantage organizations (Part C) and Medicare Part D sponsors are subject to specific federal compliance-training requirements. Under 42 CFR §§ 422.503(b)(4)(vi)(C) and 423.504(b)(4)(vi)(C), these organizations must establish and implement effective compliance training and education for specified personnel, including:

• Compliance officers.
• Organization employees.
• Chief executives.
• Senior administrators.
• Managers.
• Governing body members.

The regulations expressly require training to occur at least annually and as part of orientation for new employees and newly appointed chief executives, managers, and governing body members. These requirements are mandatory and are distinct from OIG’s voluntary guidance (42 CFR §§ 422.503(b)(4)(vi)(C), 423.504(b)(4)(vi)(C)).

It is important to distinguish the regulatory requirement for effective compliance training from a requirement to administer one particular commercial course. Organizations should ensure their training addresses the compliance risks and fraud, waste, and abuse responsibilities relevant to their operations.

What About First-Tier, Downstream, and Related Entities?

Healthcare providers, pharmacies, billing companies, and other contractors may qualify as first-tier, downstream, or related entities (FDRs) when performing functions under Medicare Advantage or Part D arrangements. In 2018, CMS eliminated the separate federal Part C/D requirement that FDRs complete the prescribed compliance-program and FWA training. CMS explained that Medicare Advantage organizations and Part D sponsors retain responsibility for overseeing their FDRs and may determine appropriate methods of ensuring compliance.

Importantly, eliminating the separate federal FDR training mandate did not eliminate an FDR’s responsibility to comply with applicable Medicare requirements.

Sponsors may still require FDRs to complete compliance or FWA training through contractual arrangements, including annual training where specified. Accordingly, healthcare organizations participating in Medicare Advantage or Part D arrangements should review their sponsor agreements to determine whether annual training, onboarding requirements, attestations, or other compliance education obligations apply to their personnel (CMS, “Contract Year 2019 Policy and Technical Changes”).

Medicaid Managed Care

Under 42 CFR § 438.608, covered Medicaid managed-care organizations must maintain compliance programs that include systems for training and educating their compliance officers, senior management, and employees regarding applicable federal and state requirements. Certain subcontractors with delegated responsibilities for coverage of services and payment of claims are also addressed within the regulation’s program-integrity framework.

The regulation does not establish one identical annual FWA course for every independent Medicaid provider. However, CMS recommends that Medicaid managed-care plans conduct compliance training upon initial hire or appointment and at regular intervals, at least annually. Applicable state contracts and managed-care agreements may establish additional requirements.

Deficit Reduction Act

Under 42 U.S.C. § 1396a(a)(68), entities receiving or making at least $5 million in annual payments under a state Medicaid plan must maintain written policies addressing specified false claims laws, whistleblower protections, and procedures for detecting and preventing fraud, waste, and abuse. These written-policy requirements extend to employees, management, contractors, and agents as provided in the statute. The provision does not independently impose a universal standalone annual online FWA course requirement. However, organizations should ensure applicable personnel receive the information necessary to understand and follow the required policies.

State and Contractual Requirements

State Medicaid programs, managed-care organizations, and healthcare contracts may establish additional compliance-training expectations. Healthcare employers should determine which requirements apply to their organization and ensure their training program addresses those obligations.

---

How Often Should Healthcare Employees Complete FWA Training?

The required frequency of healthcare fraud, waste, and abuse training depends on the organization’s regulatory obligations, contractual relationships, and operational risks.

There is no universal federal requirement that every healthcare provider administer the same annual FWA course to every employee. However, certain organizations are subject to express training-frequency requirements. For example, Medicare Advantage organizations and Part D sponsors must provide compliance training at least annually and as part of applicable orientation under 42 CFR §§ 422.503(b)(4)(vi)(C) and 423.504(b)(4)(vi)(C).

Healthcare providers and other organizations contracting with these sponsors should review their agreements for additional training requirements (42 CFR §§ 422.503, 423.504).

When Should Healthcare Organizations Provide FWA Training?

For organizations without a separately prescribed training frequency, a risk-based approach is generally appropriate. Many healthcare organizations use annual FWA training as part of their compliance programs because it creates a recurring opportunity to reinforce policies, introduce enforcement developments, and document employee education. Additional training may be appropriate in the following circumstances:

• During onboarding: Introduce compliance policies and employee reporting responsibilities.
• When job responsibilities change: Provide instruction on new risks associated with an employee’s role.
• Following a material regulatory change: Address revised laws, requirements, or organizational policies.
• After an audit or compliance incident: Reinforce requirements associated with identified deficiencies.
• During periodic refreshers: Use short lessons or scenarios to reinforce particularly important risks.

For example, a healthcare organization that identifies repeated documentation errors may benefit from a focused documentation-integrity refresher rather than requiring employees to repeat an entire FWA course. Organizations should document completion and maintain training records consistent with applicable requirements and their internal compliance policies.

Organizations developing recurring compliance education schedules may also benefit from Evolve’s healthcare compliance training calendar, which provides a month-by-month framework for organizing employee training activities.

---

How Can Online FWA Training Support an Effective Compliance Program?

Online training offers healthcare organizations a practical way to deliver consistent compliance education across departments, facilities, and employee schedules. For organizations with multiple locations or varying shifts, a learning management system can help administrators assign courses, monitor participation, and maintain training records. Solutions such as Evolve’s Learning Management System (ELMS) provide a centralized way to manage employee training, course assignments, completion records, and recurring compliance education. 

A useful online FWA program should include:

• Clear learning objectives.
• Role-relevant examples.
• Practical healthcare scenarios.
• Knowledge checks.
• Assessments.
• Completion tracking.
• Certificates or other evidence of completion.
• Accessible learning materials.
• Course reassignment and refresher capabilities.

For organizations subject to annual or onboarding training requirements, LMS reporting can also help administrators identify employees who have not completed assigned training and maintain documentation of the organization’s education efforts. Training records may help demonstrate that employees received assigned education, but completion alone does not establish that an organization’s entire compliance program is effective.

Online FWA training should complement written policies, internal monitoring, reporting procedures, management oversight, and corrective action—not replace them.

---

Strengthen Healthcare FWA Training with Evolve e-Learning Solutions

Healthcare fraud, waste, and abuse risks do not look identical across every organization. A behavioral-health provider may need additional education on treatment-duration documentation and provider qualifications, while a medical practice may place greater emphasis on medical necessity, coding, and physician referral relationships. Both need employees who understand their responsibilities and know how to recognize and report potential problems.

Evolve e-Learning Solutions helps healthcare organizations deliver practical compliance training that supports employee education and organizational compliance priorities. Our Medicare Fraud & Abuse training introduces employees to principal healthcare fraud laws, common warning signs, and reporting responsibilities.

Organizations can also explore course customization to incorporate employer policies, acknowledgments, additional scenarios, and role-specific content.

Courses can be delivered through Evolve’s hosted learning platform or, where appropriate, through an organization’s existing LMS using SCORM delivery.

Build a More Effective Healthcare Compliance Training Program

Whether you operate a physician practice, behavioral-health organization, outpatient clinic, hospital, or healthcare management company, Evolve can help you develop a training solution aligned with your workforce.

Explore Evolve’s Medicare & Corporate Compliance Training or contact us to discuss your organization’s training needs.

Explore Evolve’s Medicare & Corporate Compliance Training