Where and How to Report Medicare Fraud

Report Medicare fraud to the Office of Inspector General (OIG) at the U.S. Department of Health and Human Services. You can report online, by phone, or by mail — the OIG accepts reports from patients, family members, healthcare workers, and anyone else who suspects fraud.

The fastest route is the OIG's online form at oig.hhs.gov/fraud. You can also call the OIG hotline at 1-800-HHS-TIPS (1-800-447-8477), available Monday through Friday, 10 a.m. to 4 p.m. Eastern time. If you prefer to write, mail your report to the Office of Inspector General, U.S. Department of Health and Human Services, 330 Independence Avenue SW, Washington, DC 20201.

You can also report fraud to your state's Medicaid fraud control unit if the fraud involves both Medicare and Medicaid, or to your state's insurance commissioner. Medicare itself has a fraud reporting page at Medicare.gov where you can find state-specific contacts.

Key Takeaways

  • The Office of Inspector General accepts fraud reports by phone (1-800-447-8477), online at oig.hhs.gov/fraud, or by mail, and you can report anonymously.
  • You do not need proof — describe what you saw, when you saw it, and which provider or supplier was involved, and the OIG will investigate.
  • Common fraud includes billing for services never provided, charging for more expensive treatments than what was actually given, and submitting duplicate claims.
  • Your report is confidential; the OIG does not share your name with the provider you report unless you agree to it.
  • You cannot be fired or retaliated against for reporting fraud in good faith, even if you work for the provider.

What Counts as Medicare Fraud

Medicare fraud is when a provider, supplier, or beneficiary knowingly submits false information to Medicare to get paid. This includes billing for services that were never provided, charging for a more expensive procedure than what was actually done, submitting the same claim twice, or billing for services not medically necessary.

Examples include a doctor billing for an office visit that never happened, a hospital charging for a surgery code that costs more than the simpler procedure actually performed, a durable medical equipment supplier shipping equipment that was never ordered, or a pharmacy billing for prescriptions a patient never picked up. Upcoding — billing for a higher-level service than what was delivered — is one of the most common forms.

Fraud is different from a billing error. An error is a mistake; fraud is intentional. You do not need to prove intent to report — that is the OIG's job. If you suspect something was done on purpose to get paid incorrectly, report it.

What Information to Gather Before You Report

You do not need a complete case file. The OIG investigates based on what you provide, so gather what you can and report anyway. Start with the name and address of the provider or supplier you suspect, the type of fraud (billing for services not given, wrong amount charged, duplicate billing), and the dates when you noticed it.

If you are a patient, include your Medicare number, the dates of service, and what you remember about what happened. If you received an Explanation of Benefits (EOB) in the mail, that document is valuable — it shows what Medicare was billed and what was paid. If you work for the provider, include specific claim numbers, patient names (if you can), and the billing codes used.

Write down names of people involved if you know them, and any documents you have — receipts, bills, medical records, emails, or notes. If you witnessed something, describe exactly what you saw and when. The OIG will ask follow-up questions if they need more detail.

How the OIG Investigates Your Report

After you report, the OIG assigns your case to an investigator or refers it to the appropriate agency. They do not always contact you back — many investigations happen without the reporter's involvement. The OIG may interview the provider, request billing records, review medical records, or work with law enforcement if criminal charges are possible.

Investigations can take months or years. You will not hear updates unless you ask, and the OIG cannot share details about an ongoing investigation. If the investigation leads to charges or a settlement, that information becomes public record, but you may not be notified directly.

If your report leads to recovery of money for Medicare, you may be may have access to to a reward under the False Claims Act. The reward is a percentage of what Medicare recovers, typically between 15 and 30 percent. The OIG will contact you if your case qualifies.

Reporting Fraud as a Healthcare Worker

If you work for a hospital, clinic, medical practice, or supplier and you see fraud, you have legal protection under whistleblower laws. You cannot be fired, demoted, harassed, or punished for reporting fraud in good faith, even if you report to the OIG instead of your employer first.

Many healthcare employers have an internal compliance officer or ethics hotline. You can report there first if you feel safe doing so, or you can go directly to the OIG. If you report internally and nothing happens, or if you face retaliation, you can file a complaint with the U.S. Department of Labor or consult an employment attorney.

Document everything: dates, times, what you saw, who was involved, and any conversations about the suspected fraud. Keep copies of emails, billing records, or other evidence. If you are fired or retaliated against after reporting, this documentation will support a whistleblower claim.

What Happens to Providers Caught Committing Fraud

If the OIG substantiates fraud, the provider may face civil penalties, criminal charges, or both. Civil penalties include fines and repayment of overbilled amounts, often with interest. Providers can also be excluded from Medicare and Medicaid — meaning they cannot bill either program again, which effectively ends their practice.

Criminal charges can result in prison time and additional fines. The OIG publishes a list of excluded providers on its website; patients can search it to see if their doctor or supplier has been excluded. Exclusion is permanent unless the provider successfully appeals.

Settlements are also common. A provider may agree to pay back money, implement compliance programs, and submit to monitoring without admitting wrongdoing. These settlements are public and can damage a provider's reputation.

Protecting Yourself from Retaliation

If you report fraud and work for the provider, your employer cannot legally retaliate. Retaliation includes firing, demotion, pay cuts, schedule changes, negative performance reviews, or any other adverse action taken because you reported. If retaliation happens, you have legal recourse.

Report retaliation to the U.S. Department of Labor's Occupational Safety and Health Administration (OSHA) within 30 days of the retaliatory action. OSHA will investigate and can order your employer to reinstate you, pay back wages, and cover legal costs. You can also consult an employment attorney about filing a lawsuit.

Keep records of everything: dates you reported, to whom, what you reported, and any negative actions that followed. Email yourself summaries of conversations. If a coworker witnessed the retaliation, ask them to document it too. This evidence strengthens your case.

Frequently Asked Questions

Can I report Medicare fraud anonymously?

Yes. You can report to the OIG without giving your name. Anonymous reports are accepted and investigated, though the OIG may have fewer details to work with. If your report leads to a reward, you will need to identify yourself to collect it.

What if I am not sure it is fraud?

Report it anyway. The OIG investigates to determine whether fraud actually occurred. If you saw something that looked wrong — a charge you do not recognize, a service you do not remember receiving, or a billing code that seems too high — describe what you saw and let the investigators decide.

How long does it take to hear back after I report?

The OIG does not always contact reporters. Investigations can take months or years, and you may never hear the outcome unless you follow up. You can call the OIG to ask about your case, though they may not share details if the investigation is ongoing.

Will my doctor know I reported them?

Not unless you tell them or the OIG needs to contact you as part of the investigation. Your report is confidential. The OIG will not share your name with the provider unless you agree to it or unless your testimony becomes necessary in a legal case.

What if the fraud involves both Medicare and Medicaid?

You can report to the OIG, which handles both programs, or to your state's Medicaid fraud control unit. Either agency will investigate. Reporting to both does not hurt — they coordinate on cases involving both programs.