From recovery to prevention in Medicaid fraud, waste and abuse

Most improper Medicaid payments are never recovered. The real opportunity? Stop them before they happen.

In brief

• Fragmented systems and limited visibility create gaps that bad actors exploit — making real-time, integrated detection essential for effective program integrity.
• Legacy systems, siloed data and pay-and-chase models limit impact; real-time analytics and AI enable states to detect risk before payment.
• The greatest return comes from shifting upstream — preventing improper payments at submission rather than relying on audits months later.

In fiscal year 2025, Medicaid spent approximately $670.7 billion on medical services across all states and territories. That same year, CMS reported a national improper payment rate of 6.12% — roughly $37.39 billion in federal dollars paid incorrectly.¹ Meanwhile, Medicaid Fraud Control Units secured $2 billion in combined criminal and civil recoveries, obtained 1,185 convictions and excluded 900 individuals from federal health programs.²

Why pay-and-chase does not work anymore

Most state program integrity operations still follow a familiar cycle: process the claim, pay the provider, then audit months later and try to recover overpayments. The problem? Recovery rates are dismal. States consistently get back pennies on the dollar. The cost of investigation, legal proceedings and collection often exceeds what they recover from smaller cases.

The root causes are familiar to many who have worked inside these systems:

• Legacy platforms were never built for detection: Many state systems process transactions — they do not analyze patterns. Getting claims data out for analytics requires batch extracts with 24- to 72-hour delays. By then, payments have already cleared.
• Nobody sees the full picture: A typical state Medicaid program involves a fiscal agent, three to five managed care organizations, a pharmacy benefit manager, a dental administrator and multiple specialty vendors. Without intentional integration, no single entity has complete visibility.
• Human reviewers cannot keep up: In my experience, a mid-size state processes 50 million to 80 million claims per year. The majority of claims are evaluated only by automated edits — and those edits catch known patterns, not new schemes.
• Prompt payment rules create tension: Under 42 CFR 447.45, states must pay 90% of clean practitioner claims within 30 days of receipt.⁵ Prepayment review has to operate within that window or risk violating federal timeliness standards and alienating legitimate providers. This is not a trivial constraint — it shapes what is architecturally feasible.

A practical framework: four levels of fraud, waste and abuse (FWA) technology maturity

After leading implementations in multiple states, I have come to think about FWA technology capability in four stages. Most programs operate somewhere between the first two. The ones producing real results are pushing into the third, with the fourth just beginning to prove itself.

The jump from Level 2 to Level 3 is where I see the biggest return. You stop bleeding money and start preventing losses. Everything above that compounds the advantage.

Technology solutions driving modern FWA detection

The most effective FWA programs I have seen combine multiple technology layers working in coordination. Let me walk through what this looks like in practice, layer by layer.

Governance is not optional

Every model, every algorithm, every AI-generated finding must be explainable. CMS requires it. Providers have due process rights. When a payment is suspended based on an ML score or an LLM’s assessment of clinical documentation, the state has to explain why — clearly and with evidence. Opaque scores do not survive legal challenge.

The same principle applies to operational decisions. Technology should not automate inefficient processes or inconsistent policies. Before implementing advanced analytics or AI, states should evaluate whether underlying workflows, escalation paths and review processes are designed for the outcome they want to achieve. Modernizing technology without modernizing operations simply accelerates existing inefficiencies.

Cross-agency collaboration expands what any single entity can see. Medicaid fraud intersects with Medicaid Fraud Control Units, state licensing boards, CMS’s Unified Program Integrity Contractors (UPICs) and the Office of Inspector General. Platforms need to support secure data sharing while staying within HIPAA, 42 CFR Part 2 and state privacy law.

And here is one that program leaders often underestimate: managed care encounter data. MCOs process the majority of Medicaid volume in most states. If your managed care contracts do not mandate timely, standardized encounter submission, your program integrity operation is working with less than half the picture.

Governance also requires balancing integrity objectives with access to care. States are understandably cautious about introducing new prepayment controls that could delay services, create provider friction or generate political scrutiny. The goal is not to slow legitimate claims processing. It is to apply intelligent risk-based review that protects taxpayer dollars while confirming beneficiaries continue receiving timely care and providers are paid promptly for appropriate services.

What I have seen work — and what has not

A few patterns show up consistently in programs that deliver real results:

Start with data quality. Poor data quality leads to false positives, which means investigator fatigue, which means real fraud gets buried in noise. Invest in provider enrollment validation as a front-door defense — screen thoroughly before providers enter the program so you spend less effort catching them after.

Just as important, invest in the people using the system. The strongest program integrity organizations treat workforce development as a core component of modernization. Investigators, clinicians, data analysts and program integrity leaders need new skills to effectively interpret risk scores, validate findings and continuously improve detection approaches. Sustainable results come from building workforce capability alongside technology capability.

Deploy rules for what you know. Reserve ML for discovering what you do not. Build feedback loops so investigation outcomes improve model accuracy over time. This is not a one-time implementation — it is a living system.

The most successful programs also take an incremental approach. Rather than attempting enterprise-wide transformation all at once, they focus on targeted use cases, demonstrate measurable value and expand capabilities over time. This modular strategy aligns well with CMS certification expectations, state funding cycles and the realities of organizational change.

Engage clinical staff and policy professionals from day one. The best fraud detection reflects deep program knowledge. A data scientist who does not understand how home and community-based services waiver services are authorized will build models that flag legitimate claims and miss actual fraud.

And do not underestimate change management. Program integrity is an organizational capability, not a procurement. The technology only works when investigators trust it, policy staff inform it and leadership funds it sustainably.

Where this is headed

The direction is clear. We are moving from periodic audits toward continuous, intelligent prevention. Real-time streaming catches problems at the moment of submission. AI reads documentation the way a clinical reviewer would — but across every claim, not just the ones someone manually selects. Federated approaches let states learn from each other’s patterns without sharing protected data.

The CMS interoperability framework announced in July 2025, with over 60 organizations signed on, signals that the infrastructure for connected, real-time health data exchange is becoming standard rather than aspirational. States that align their technology investments with MITA 3.0 maturity principles and pursue enhanced FFP for modular, certified systems will be positioned to act on these capabilities as they mature.

The path forward is unlikely to be a single large-scale transformation initiative. More often, progress will come through modular and agile modernization efforts that advance programs incrementally through the four maturity levels. States that can demonstrate measurable improvements in payment accuracy, investigative efficiency and provider experience will be better positioned to sustain funding and continue scaling capabilities over time.

The math is straightforward, but the value extends beyond avoided losses. Effective program integrity improves public trust, reduces administrative burden on providers, allows investigators to focus on the highest-risk cases and helps confirm limited Medicaid dollars are directed toward individuals and families who need services most. 

The question for Medicaid leadership is not whether to modernize FWA detection, but how quickly they can move from reactive investigation to proactive prevention — how fast we move from talking about it to building it.