Detecting Health Care Fraud
5 minutes
5 Questions
Detecting health care fraud, within the Certified Fraud Examiner (CFE) framework, involves identifying schemes in which providers, patients, insurers, or other parties intentionally deceive health care programs for financial gain. Common schemes include billing for services not rendered, upcoding (billing for a more expensive service than performed), unbundling (billing separately for procedures normally grouped), phantom patients, kickbacks, medically unnecessary services, and duplicate billing. CFEs detect these schemes through several complementary approaches. First, data analytics is central: examiners analyze claims data for anomalies such as unusually high billing volumes per provider, services billed on weekends or holidays, impossible daily service hours (e.g., a physician billing 30 hours in a day), and statistical outliers compared to peer providers. Benford's Law and trend analysis help flag suspicious patterns in billing amounts and frequencies. Second, red flags are monitored. These include patients receiving identical treatments regardless of diagnosis, frequent waiver of copayments, providers who routinely bill at the highest reimbursement codes, excessive referrals to related entities, altered medical records, and complaints from beneficiaries who received Explanation of Benefits statements for services they never received. Third, document examination compares medical records against submitted claims to confirm that documented services match what was billed, that signatures and dates are consistent, and that medical necessity is supported. Fourth, interviews and tips remain highly effective. Whistleblowers, employees, and patients frequently expose fraud; hotlines and qui tam provisions under the False Claims Act encourage reporting. Finally, CFEs rely on predictive modeling and Special Investigations Units within insurers and government programs such as Medicare's Fraud Prevention System, which screen claims before payment. Effective detection combines technology, professional skepticism, knowledge of coding and regulatory requirements, and coordination with law enforcement to prevent losses and support prosecution.
Detecting Health Care Fraud: A Complete ACFE CFE Exam Guide
Why Detecting Health Care Fraud Matters
Health care fraud is one of the costliest categories of occupational and external fraud in the world. The U.S. National Health Care Anti-Fraud Association estimates losses in the tens of billions of dollars every year, and the problem exists in every country that operates public or private health insurance programs. Because health care spending flows through millions of claims, thousands of providers, and complex coding systems, fraudsters have countless opportunities to hide false billing inside legitimate activity. For a Certified Fraud Examiner, understanding how to detect health care fraud is essential: it protects government programs such as Medicare and Medicaid, private insurers, employers who sponsor benefit plans, and ultimately patients whose care and safety can be compromised by unnecessary procedures, falsified records, or diverted drugs.
On the CFE Exam, this topic appears within the Financial Transactions and Fraud Schemes section. Questions test whether you can recognize the red flags, analytical techniques, and investigative steps that reveal provider, patient, insurer-employee, and organized-crime schemes.
What Is Health Care Fraud?
Health care fraud is the intentional deception or misrepresentation made by a person or entity with the knowledge that the deception could result in an unauthorized benefit to themselves or another party within the health care system. It is distinct from abuse, which involves practices inconsistent with sound medical or business practice that result in unnecessary cost but lack clear intent, and from simple error, which is unintentional.
Key perpetrators include:
• Providers – physicians, hospitals, clinics, laboratories, pharmacies, durable medical equipment (DME) suppliers, home health agencies, ambulance companies
• Patients/beneficiaries – individuals who fake conditions, lend ID cards, or doctor-shop for drugs
• Insurer employees and third-party administrators – insiders who manipulate claim adjudication
• Organized crime rings – groups that create phantom clinics, steal patient and provider identities, and bill in bulk
Common Schemes You Must Recognize
Provider schemes:
• Fictitious or phantom billing – billing for services never rendered, or billing for deceased or nonexistent patients
• Upcoding – billing a higher-paying code than the service actually performed (e.g., billing a comprehensive office visit for a brief one)
• Unbundling – billing separately for procedures that should be billed under one bundled code to increase total reimbursement
• Duplicate billing – submitting the same claim multiple times, sometimes to different payers
• Medically unnecessary services – performing or ordering tests and procedures not required by the patient's condition
• Kickbacks and self-referrals – paying or receiving remuneration for referrals (violating anti-kickback statutes) or referring to entities in which the provider has a financial interest (Stark Law in the U.S.)
• Waiving copayments and deductibles routinely, then inflating charges to the insurer
• Misrepresenting the provider – services performed by unlicensed or lower-level staff billed as if performed by a physician
• Misrepresenting dates or locations of service to qualify for coverage
• DME fraud – billing for equipment never delivered, or more expensive equipment than supplied
• Rolling labs – mobile labs that perform unnecessary tests at health fairs or shopping centers and bill insurers
• Pharmacy fraud – shorting prescriptions, billing brand-name while dispensing generic, drug diversion
Patient schemes:
• Doctor shopping and prescription drug fraud
• Sharing or selling insurance identification cards
• Falsifying claims or receipts for reimbursement
• Feigning injury or illness for disability or workers' compensation
Insider schemes:
• Claims processors approving false claims for accomplices
• Manipulating provider master files to redirect payments
• Creating fictitious providers in the payment system
How Detection Works
Effective detection combines data analytics, document review, interviews, and knowledge of medical coding. The main methods include:
1. Data Analytics and Statistical Profiling
• Peer comparison – comparing a provider's billing patterns against peers in the same specialty and region. Outliers in volume, average charge per patient, or code distribution are red flags.
• Trend analysis – sudden spikes in billing, new procedure codes, or increased patient counts
• Benford's Law – analyzing digit frequency in claim amounts
• Duplicate detection – matching on patient, date, procedure code, and provider
• Impossible-day analysis – totaling the time value of procedures billed in a single day; a physician billing 30 hours of services in one day indicates fraud
• Geographic analysis – patients traveling unusual distances, or many patients sharing the same address
• Code pairing/edit logic – identifying unbundled codes, mutually exclusive procedures, or gender/age-inappropriate services (e.g., hysterectomy billed for a male patient)
• Link analysis – connecting providers, patients, addresses, bank accounts, and phone numbers to uncover organized rings
2. Red Flags in Claims and Records
• High percentage of the most expensive evaluation and management codes
• Identical diagnoses for a large share of patients
• Round-number or repetitive billing amounts
• Services billed on weekends, holidays, or dates the provider was traveling
• Patient complaints about services never received or explanation-of-benefits (EOB) discrepancies
• Lack of supporting documentation, altered medical records, or records that are suspiciously uniform ('cloned' notes)
• Provider with no physical office, a mail drop, or a newly enrolled high-volume biller
• Unusually high number of referrals to a single lab, DME supplier, or imaging center
• Prescriptions for controlled substances far exceeding norms
3. Document and Medical Record Review
Examiners compare claims to medical charts, appointment logs, sign-in sheets, lab requisitions, and supply inventories. The core question is: Does the documentation support the service, the code, the date, and the provider billed? Clinical coders or medical consultants are often engaged to evaluate medical necessity and coding accuracy.
4. Interviews and Verification
• Contacting patients directly to verify services were received (beneficiary verification letters or calls)
• Interviewing former employees, billing staff, and competitors
• Verifying licenses, credentials, and sanction status against exclusion databases (e.g., OIG List of Excluded Individuals/Entities)
• Site visits to confirm the provider physically exists and operates
5. Hotlines and Whistleblowers
Tips remain the most common initial detection method for occupational fraud generally, and health care is no exception. Employees, patients, and competitors frequently report suspicious billing. Qui tam provisions of the False Claims Act in the United States incentivize whistleblowers by allowing them to share in recoveries.
6. Special Investigation Units (SIUs) and Pre-Payment Edits
Insurers maintain SIUs that run automated pre-payment edits (rejecting invalid code combinations) and post-payment audits. Predictive modeling scores claims for fraud probability before payment is released.
Key Terminology to Memorize
• CPT codes – Current Procedural Terminology; describe procedures and services
• ICD codes – International Classification of Diseases; describe diagnoses
• HCPCS – Healthcare Common Procedure Coding System; includes DME and supplies
• DRG – Diagnosis-Related Group; hospital inpatient payment classification; 'DRG creep' is upcoding at the hospital level
• EOB – Explanation of Benefits sent to the patient
• Medical necessity – the standard that services must be reasonable and necessary for diagnosis or treatment
• Capitation – fixed per-patient payment to providers; the fraud risk shifts to underutilization and denial of care rather than overbilling
• Fee-for-service – payment per procedure; the fraud risk is overutilization and overbilling
Exam Tips: Answering Questions on Detecting Health Care Fraud
Tip 1 – Match the scheme to its definition precisely. The exam loves to test the difference between upcoding (one code replaced with a more expensive one) and unbundling (one bundled code split into several). If the question describes billing components separately, the answer is unbundling. If it describes billing a more complex level of the same service, it is upcoding.
Tip 2 – Know which red flag points to which scheme. Many patients with the same diagnosis suggests fictitious or boilerplate billing; a high ratio of the most expensive E&M codes suggests upcoding; impossible hours in a day suggests phantom billing; patients from far outside the service area suggests a rolling lab or organized ring.
Tip 3 – Remember that fraud requires intent. If a question asks whether a pattern of billing errors is fraud or abuse, look for words indicating knowledge and intent. Without intent, the correct classification is abuse or error, even if the financial impact is identical.
Tip 4 – Fee-for-service versus capitation. Under fee-for-service the incentive is to do too much; under capitation or managed care the incentive is to do too little. If a question asks about fraud under a capitated plan, think of denying care, failing to refer, or enrolling phantom members, not overbilling.
Tip 5 – Peer comparison is the foundational analytic. When asked for the most effective or first data analysis step, comparing the provider against similar providers (same specialty, same region) is usually the best answer, because it establishes a baseline for identifying outliers.
Tip 6 – Patient verification is a direct detection tool. If the question asks how to confirm whether a billed service was actually rendered, contacting the patient (or reviewing EOB complaints) is the most direct approach; reviewing the provider's own records alone is insufficient because they may be falsified.
Tip 7 – Watch for 'EXCEPT' and 'LEAST LIKELY' questions. The exam frequently lists three genuine red flags and one neutral item. A provider billing a wide variety of codes across many diagnoses is less suspicious than one billing identical codes for every patient.
Tip 8 – Distinguish kickbacks from self-referral. Kickbacks involve remuneration in exchange for referrals (bribes, free rent, sham consulting fees). Self-referral involves a physician referring to a facility in which the physician has an ownership or compensation interest. Both are illegal under U.S. law, but they are tested as separate concepts.
Tip 9 – Remember the roles of insiders. Not every health care fraud is committed by a doctor. If the facts describe a claims adjuster, provider-file clerk, or benefits administrator, look for answers involving manipulation of the payment system or collusion with an outside provider.
Tip 10 – Use elimination and ACFE logic. ACFE questions favor the most comprehensive, systematic, and legally defensible answer. When two answers both seem plausible, prefer the one that gathers independent evidence (third-party verification, data analytics) over the one that relies solely on the suspect's own assertions or records.
Quick Review Summary
• Health care fraud = intentional misrepresentation for unauthorized benefit; abuse lacks intent.
• Major provider schemes: phantom billing, upcoding, unbundling, duplicate billing, unnecessary services, kickbacks, self-referral, DME fraud, rolling labs.
• Detection tools: peer comparison, trend analysis, impossible-day analysis, code edits, link analysis, record review, patient verification, site visits, hotlines, SIU pre-payment edits.
• Red flags: identical diagnoses, top-tier codes, impossible volumes, round numbers, missing or cloned documentation, patients far from the provider, services on dates the provider was absent.
• Payment model determines fraud direction: fee-for-service drives overutilization; capitation drives underutilization.
Master these distinctions, practice identifying the scheme from a fact pattern, and you will be well prepared to answer any CFE Exam question on detecting health care fraud.
Health care fraud is one of the costliest categories of occupational and external fraud in the world. The U.S. National Health Care Anti-Fraud Association estimates losses in the tens of billions of dollars every year, and the problem exists in every country that operates public or private health insurance programs. Because health care spending flows through millions of claims, thousands of providers, and complex coding systems, fraudsters have countless opportunities to hide false billing inside legitimate activity. For a Certified Fraud Examiner, understanding how to detect health care fraud is essential: it protects government programs such as Medicare and Medicaid, private insurers, employers who sponsor benefit plans, and ultimately patients whose care and safety can be compromised by unnecessary procedures, falsified records, or diverted drugs.
On the CFE Exam, this topic appears within the Financial Transactions and Fraud Schemes section. Questions test whether you can recognize the red flags, analytical techniques, and investigative steps that reveal provider, patient, insurer-employee, and organized-crime schemes.
What Is Health Care Fraud?
Health care fraud is the intentional deception or misrepresentation made by a person or entity with the knowledge that the deception could result in an unauthorized benefit to themselves or another party within the health care system. It is distinct from abuse, which involves practices inconsistent with sound medical or business practice that result in unnecessary cost but lack clear intent, and from simple error, which is unintentional.
Key perpetrators include:
• Providers – physicians, hospitals, clinics, laboratories, pharmacies, durable medical equipment (DME) suppliers, home health agencies, ambulance companies
• Patients/beneficiaries – individuals who fake conditions, lend ID cards, or doctor-shop for drugs
• Insurer employees and third-party administrators – insiders who manipulate claim adjudication
• Organized crime rings – groups that create phantom clinics, steal patient and provider identities, and bill in bulk
Common Schemes You Must Recognize
Provider schemes:
• Fictitious or phantom billing – billing for services never rendered, or billing for deceased or nonexistent patients
• Upcoding – billing a higher-paying code than the service actually performed (e.g., billing a comprehensive office visit for a brief one)
• Unbundling – billing separately for procedures that should be billed under one bundled code to increase total reimbursement
• Duplicate billing – submitting the same claim multiple times, sometimes to different payers
• Medically unnecessary services – performing or ordering tests and procedures not required by the patient's condition
• Kickbacks and self-referrals – paying or receiving remuneration for referrals (violating anti-kickback statutes) or referring to entities in which the provider has a financial interest (Stark Law in the U.S.)
• Waiving copayments and deductibles routinely, then inflating charges to the insurer
• Misrepresenting the provider – services performed by unlicensed or lower-level staff billed as if performed by a physician
• Misrepresenting dates or locations of service to qualify for coverage
• DME fraud – billing for equipment never delivered, or more expensive equipment than supplied
• Rolling labs – mobile labs that perform unnecessary tests at health fairs or shopping centers and bill insurers
• Pharmacy fraud – shorting prescriptions, billing brand-name while dispensing generic, drug diversion
Patient schemes:
• Doctor shopping and prescription drug fraud
• Sharing or selling insurance identification cards
• Falsifying claims or receipts for reimbursement
• Feigning injury or illness for disability or workers' compensation
Insider schemes:
• Claims processors approving false claims for accomplices
• Manipulating provider master files to redirect payments
• Creating fictitious providers in the payment system
How Detection Works
Effective detection combines data analytics, document review, interviews, and knowledge of medical coding. The main methods include:
1. Data Analytics and Statistical Profiling
• Peer comparison – comparing a provider's billing patterns against peers in the same specialty and region. Outliers in volume, average charge per patient, or code distribution are red flags.
• Trend analysis – sudden spikes in billing, new procedure codes, or increased patient counts
• Benford's Law – analyzing digit frequency in claim amounts
• Duplicate detection – matching on patient, date, procedure code, and provider
• Impossible-day analysis – totaling the time value of procedures billed in a single day; a physician billing 30 hours of services in one day indicates fraud
• Geographic analysis – patients traveling unusual distances, or many patients sharing the same address
• Code pairing/edit logic – identifying unbundled codes, mutually exclusive procedures, or gender/age-inappropriate services (e.g., hysterectomy billed for a male patient)
• Link analysis – connecting providers, patients, addresses, bank accounts, and phone numbers to uncover organized rings
2. Red Flags in Claims and Records
• High percentage of the most expensive evaluation and management codes
• Identical diagnoses for a large share of patients
• Round-number or repetitive billing amounts
• Services billed on weekends, holidays, or dates the provider was traveling
• Patient complaints about services never received or explanation-of-benefits (EOB) discrepancies
• Lack of supporting documentation, altered medical records, or records that are suspiciously uniform ('cloned' notes)
• Provider with no physical office, a mail drop, or a newly enrolled high-volume biller
• Unusually high number of referrals to a single lab, DME supplier, or imaging center
• Prescriptions for controlled substances far exceeding norms
3. Document and Medical Record Review
Examiners compare claims to medical charts, appointment logs, sign-in sheets, lab requisitions, and supply inventories. The core question is: Does the documentation support the service, the code, the date, and the provider billed? Clinical coders or medical consultants are often engaged to evaluate medical necessity and coding accuracy.
4. Interviews and Verification
• Contacting patients directly to verify services were received (beneficiary verification letters or calls)
• Interviewing former employees, billing staff, and competitors
• Verifying licenses, credentials, and sanction status against exclusion databases (e.g., OIG List of Excluded Individuals/Entities)
• Site visits to confirm the provider physically exists and operates
5. Hotlines and Whistleblowers
Tips remain the most common initial detection method for occupational fraud generally, and health care is no exception. Employees, patients, and competitors frequently report suspicious billing. Qui tam provisions of the False Claims Act in the United States incentivize whistleblowers by allowing them to share in recoveries.
6. Special Investigation Units (SIUs) and Pre-Payment Edits
Insurers maintain SIUs that run automated pre-payment edits (rejecting invalid code combinations) and post-payment audits. Predictive modeling scores claims for fraud probability before payment is released.
Key Terminology to Memorize
• CPT codes – Current Procedural Terminology; describe procedures and services
• ICD codes – International Classification of Diseases; describe diagnoses
• HCPCS – Healthcare Common Procedure Coding System; includes DME and supplies
• DRG – Diagnosis-Related Group; hospital inpatient payment classification; 'DRG creep' is upcoding at the hospital level
• EOB – Explanation of Benefits sent to the patient
• Medical necessity – the standard that services must be reasonable and necessary for diagnosis or treatment
• Capitation – fixed per-patient payment to providers; the fraud risk shifts to underutilization and denial of care rather than overbilling
• Fee-for-service – payment per procedure; the fraud risk is overutilization and overbilling
Exam Tips: Answering Questions on Detecting Health Care Fraud
Tip 1 – Match the scheme to its definition precisely. The exam loves to test the difference between upcoding (one code replaced with a more expensive one) and unbundling (one bundled code split into several). If the question describes billing components separately, the answer is unbundling. If it describes billing a more complex level of the same service, it is upcoding.
Tip 2 – Know which red flag points to which scheme. Many patients with the same diagnosis suggests fictitious or boilerplate billing; a high ratio of the most expensive E&M codes suggests upcoding; impossible hours in a day suggests phantom billing; patients from far outside the service area suggests a rolling lab or organized ring.
Tip 3 – Remember that fraud requires intent. If a question asks whether a pattern of billing errors is fraud or abuse, look for words indicating knowledge and intent. Without intent, the correct classification is abuse or error, even if the financial impact is identical.
Tip 4 – Fee-for-service versus capitation. Under fee-for-service the incentive is to do too much; under capitation or managed care the incentive is to do too little. If a question asks about fraud under a capitated plan, think of denying care, failing to refer, or enrolling phantom members, not overbilling.
Tip 5 – Peer comparison is the foundational analytic. When asked for the most effective or first data analysis step, comparing the provider against similar providers (same specialty, same region) is usually the best answer, because it establishes a baseline for identifying outliers.
Tip 6 – Patient verification is a direct detection tool. If the question asks how to confirm whether a billed service was actually rendered, contacting the patient (or reviewing EOB complaints) is the most direct approach; reviewing the provider's own records alone is insufficient because they may be falsified.
Tip 7 – Watch for 'EXCEPT' and 'LEAST LIKELY' questions. The exam frequently lists three genuine red flags and one neutral item. A provider billing a wide variety of codes across many diagnoses is less suspicious than one billing identical codes for every patient.
Tip 8 – Distinguish kickbacks from self-referral. Kickbacks involve remuneration in exchange for referrals (bribes, free rent, sham consulting fees). Self-referral involves a physician referring to a facility in which the physician has an ownership or compensation interest. Both are illegal under U.S. law, but they are tested as separate concepts.
Tip 9 – Remember the roles of insiders. Not every health care fraud is committed by a doctor. If the facts describe a claims adjuster, provider-file clerk, or benefits administrator, look for answers involving manipulation of the payment system or collusion with an outside provider.
Tip 10 – Use elimination and ACFE logic. ACFE questions favor the most comprehensive, systematic, and legally defensible answer. When two answers both seem plausible, prefer the one that gathers independent evidence (third-party verification, data analytics) over the one that relies solely on the suspect's own assertions or records.
Quick Review Summary
• Health care fraud = intentional misrepresentation for unauthorized benefit; abuse lacks intent.
• Major provider schemes: phantom billing, upcoding, unbundling, duplicate billing, unnecessary services, kickbacks, self-referral, DME fraud, rolling labs.
• Detection tools: peer comparison, trend analysis, impossible-day analysis, code edits, link analysis, record review, patient verification, site visits, hotlines, SIU pre-payment edits.
• Red flags: identical diagnoses, top-tier codes, impossible volumes, round numbers, missing or cloned documentation, patients far from the provider, services on dates the provider was absent.
• Payment model determines fraud direction: fee-for-service drives overutilization; capitation drives underutilization.
Master these distinctions, practice identifying the scheme from a fact pattern, and you will be well prepared to answer any CFE Exam question on detecting health care fraud.
Test mode:
CFE - Detecting Health Care Fraud Example Questions
Test your knowledge of Detecting Health Care Fraud
Question 1
A fraud examiner compares an outpatient clinic's claims with a hospital's admission records. The clinic billed for therapy sessions on dates when the listed patients were admitted as inpatients at the hospital. The billed codes match the clinic's usual mix, and the treatments are standard for the patients' diagnoses. Which scheme does this pattern MOST strongly indicate?
Question 2
Which document mailed to an insured patient lists the services billed under the policy, allowing the patient to spot charges for care never received?
Question 3
An insurer's hotline receives calls from several elderly patients of a home health agency. Each says the benefit statement lists nursing visits that never took place, and each listed visit falls on a separate date. The fraud examiner assigned to the matter wants a data analytics test that can confirm across the agency's whole patient population that billed services were not actually delivered. Which test is the BEST choice?
Unlock Premium Access
Certified Fraud Examiner (CFE)
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 3404 Superior-grade Certified Fraud Examiner (CFE) practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CFE: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Detecting Health Care Fraud questions
9 questions (total)