Fraud, Waste, and Abuse Policy Template for NEMT Companies: Billing, Reporting, and Paybacks

Brokers that pay you for Medicaid and Medicare Advantage rides are required to fight fraud, waste, and abuse, and they pass part of that job to you through contracts, attestations, and yearly training. This template is the policy behind those signatures: what your company never bills, how anyone can raise a concern, what happens after a report, and how money paid in error goes back.

How to use this template

1. Fill in Part 1 first. Name your compliance contact, a backup, and every broker, health plan, and state program you bill. OIG’s General Compliance Program Guidance (November 2023) lets a small company name one compliance contact who reports to the owner at least every quarter and, whenever possible, does not bill, code, or submit claims. NEMT compliance program shows where this policy fits among the other six elements.
2. Copy each broker’s reporting line into Part 8. MTM Health’s Virginia handbook (approved August 10, 2026) and Rhode Island handbook (July 1, 2026) send fraud, waste, and abuse reports to an outside hotline, open 24 hours, at 888-298-4033, with an online form and access ID listed in each handbook. Modivcare’s 2025 provider training lists its Ethics and Compliance Hotline at 855-818-6929. Find the line for every other broker and plan in its agreement or manual.
3. Write in your state’s law. Part 7 has a blank for your state’s false claims act and Part 8 one for its Medicaid Fraud Control Unit. OIG lists the state false claims acts it has reviewed.
4. Edit it to fit. OIG says templates are fine if you review them and change them to match your operations and risks. Cross out what does not apply, and write in any broker rule that is stricter than this one.
5. Train, then sign. Everyone reads the policy, is trained on it, and signs Part 15 before their first Medicaid trip, then every year. Record the training on the driver training log.
6. Post Part 8. OIG says a small company where reports cannot stay anonymous should post how to reach the OIG Hotline in common areas. Put a copy in the drivers’ room and by the time clock.
7. Put it in your handbook. If you have an employee handbook, add this policy or its Part 7 summary of the laws. The NEMT driver handbook has a place for it.
8. Keep it for 10 years. Modivcare’s 2025 attestation asks for training records for at least 10 years, and MTM Health’s standard agreement asks for full records for 10 years.

The template

Part 1: Policy details

Field	Entry
Company name
Effective date
Last reviewed
Owner responsible for this policy
Compliance contact (name, phone, email)
Backup contact when the compliance contact is away
Brokers, health plans, and state programs we bill
Billing company we use, if any
This policy covers	Owners, managers, office staff, dispatchers, billers, drivers, attendants, contractors, and our billing company

Part 2: Why we have this policy

We are paid with Medicaid, Medicare, and other public money. Every claim we send says a ride happened the way we billed it. This policy sets out how we keep that true, how anyone here can raise a concern, and what we do when something goes wrong. Breaking it can cost the company its contracts and its right to bill public programs, and it can cost a person their job.

Part 3: What the words mean

• Fraud is knowingly lying or hiding the truth to get paid something we are not owed. Billing a ride that never happened is fraud.
• Waste is using program money carelessly, such as running a longer route than the trip needs.
• Abuse is a billing or business practice that costs the program money it should not have spent, such as billing a higher level of service than the rider received, even without a plan to deceive.
• An honest mistake still matters. We fix it, pay back what we were overpaid, and change the process so it does not happen again.

Part 4: What we never do

Billing

1. Bill a trip or a leg that did not happen, or both legs of a round trip when only one ran.
2. Bill a no-show, a cancellation, or a trip turned back to the broker as a completed trip.
3. Bill a wheelchair or stretcher rate for a rider who was approved for and rode at an ambulatory level, even when we sent a wheelchair van.
4. Bill miles driven without the rider aboard, or miles from a longer route than the trip needed.
5. Bill a trip for a rider who has died, or under a rider’s ID without the rider’s knowledge.
6. Bill a trip run by a driver, attendant, or vehicle the broker had not approved, or by anyone on an exclusion list.
7. Ask a Medicaid rider to pay for a covered trip, unless the broker or plan allows a copay.

Trip records

8. Sign for a rider, or have a rider sign a blank log or a log for a trip that did not happen.
9. Change a time, mileage, or signature on a trip record without marking the change, the date, the reason, and who made it.
10. Fill in a trip record before the trip happens, or copy times from another day.
11. Write a trip purpose we know is false so a ride looks covered.

Gifts and referrals

12. Give a rider cash, a gift card, a meal, a free ride elsewhere, or anything else of value.
13. Pay or give anything to facility staff, case managers, or anyone else for sending us trips, or take anything from a clinic for bringing riders to it.
14. Give anything of value to a broker’s or plan’s employee.

Part 5: Fraud by others that we report

Tell the compliance contact right away about any of these. The compliance contact reports it to the broker.

• A rider asks a driver to sign for a ride they did not take, to add a stop that is not medical, or to bill a different address.
• Someone uses another person’s Medicaid ID or name to get a ride.
• Facility staff or anyone else offers us trips in return for money, gifts, or favors.
• A broker or plan employee asks for anything in return for trips.

Part 6: Checks we run

Check	How often	Done by	Last done
Screen owners, staff, drivers, attendants, and contractors against the OIG list, SAM.gov, and our state’s Medicaid exclusion list	Before hire, then monthly
Match a sample of claims to trip logs, signatures, and odometer or GPS miles	Monthly
Call a few riders or appointment sites to confirm rides happened	Monthly
Confirm every trip in a billing batch had an approved driver, attendant, and vehicle	Each batch
Fraud, waste, and abuse training for everyone	At hire, then yearly
Review this policy, the concerns log, and the refund log	Yearly

Keep the screening results on the exclusion screening log.

Part 7: The laws everyone here should know

• The federal False Claims Act (31 U.S.C. 3729 to 3733). Anyone who knowingly sends a false claim, makes a false record to get one paid, or keeps money they know must go back owes three times the government’s loss plus a penalty for each claim. For penalties assessed after July 3, 2025, that penalty is $14,308 to $28,619 per claim. “Knowingly” includes deliberate ignorance and reckless disregard, so no proof of intent to defraud is needed. Each trip billed can be a claim.
• Whistleblower cases. A private person can file a False Claims Act case for the government, under seal. If it succeeds, that person receives 15 to 25 percent of the recovery when the government takes the case, and 25 to 30 percent when it does not.
• The Program Fraud Civil Remedies Act (31 U.S.C. 3801 to 3812). Federal agencies such as HHS can impose a civil penalty for each false claim or statement, plus up to twice the amount claimed, through their own administrative hearing instead of a lawsuit.
• Our state’s false claims law: ______________________ (name and citation).
• The Anti-Kickback Statute (42 U.S.C. 1320a-7b(b)). Knowingly and willfully offering, paying, asking for, or taking anything of value for referrals of rides a federal health care program pays for is a felony, with fines up to $100,000 and up to 10 years in prison.
• Gifts to riders (42 U.S.C. 1320a-7a(a)(5)). Giving a Medicare or Medicaid member anything we know or should know is likely to make them choose us brings civil money penalties.
• Exclusion. OIG can bar people and companies from all federal health care programs. No federal program pays for anything an excluded person furnishes, so the trips they drive or dispatch can become overpayments.
• Protection for people who report (31 U.S.C. 3730(h)). An employee, contractor, or agent who is fired, demoted, suspended, threatened, or harassed for lawful acts to stop a false claim is entitled to reinstatement, two times back pay with interest, special damages, and attorneys’ fees. Many state false claims laws protect whistleblowers too.

Part 8: How to report a concern

Report anything you believe in good faith may be fraud, waste, abuse, or a break of this policy. You do not need proof first. You may use any line below, in any order, including going straight to the government.

Who	Phone	Email, website, or location
Our compliance contact
The owner
Anonymous drop box
Broker or plan hotline:
Broker or plan hotline:
Our state’s Medicaid Fraud Control Unit
HHS Office of Inspector General Hotline	1-800-HHS-TIPS (1-800-447-8477), TTY 1-800-377-4950	oig.hhs.gov/fraud/report-fraud

1. You may report anonymously. If you give your name, we keep it private as far as the law and the investigation allow.
2. Knowing about fraud and not reporting it breaks this policy.
3. Do not investigate on your own. Never take records home, change them, or confront the person. Tell the compliance contact.

Part 9: No retaliation

We never fire, demote, suspend, threaten, harass, cut the hours or trips of, or otherwise punish anyone for reporting a concern in good faith, helping an investigation, or reporting to a broker or the government. Anyone who retaliates is disciplined under Part 13. Report retaliation through any line in Part 8.

Part 10: What happens after a report

1. The compliance contact writes the report in the log below within one business day.
2. Records stay as they are. The compliance contact secures the trip logs, GPS data, signatures, dispatch logs, and claims involved, and nothing is deleted.
3. The compliance contact looks into it: interviews the people involved and compares the claims with the records.
4. Anyone whose presence could harm the investigation comes off that work until it ends.
5. We stop billing the affected trips until we know what happened.
6. The compliance contact and the owner decide what follows: a fix, a refund under Part 11, discipline under Part 13, and any report to the broker, plan, or government. If we find credible evidence that the law may have been broken, we talk to a health care attorney and tell the right government office within 60 days.
7. We tell the person who reported that the matter was handled, without sharing private details.
8. We write down what we changed so it does not happen again.

Date received	How it came in	What was reported	Handled by	What we found and did	Date closed

Part 11: Paying money back

1. When we find we were paid for a trip we should not have billed, we stop billing that kind of trip until the cause is fixed.
2. We find every claim the problem touched, for as far back as it goes.
3. We report and return the money within 60 days after we identify it, with a written reason, through the refund process of whoever paid us: the broker, the health plan, or the state.
4. If the problem may be fraud, the owner talks to a health care attorney before the refund about whether to self-disclose.
5. We answer every broker, plan, or state request for records or an explanation by the date it sets.

Date found	Trips and dates of service	Why we were overpaid	Amount	Paid by	Returned on, and how

Part 12: Audits and investigators

1. We cooperate with audits and investigations by brokers, health plans, the state, and federal agencies.
2. We keep a copy of every record we hand over.
3. Anyone here may talk to a government investigator. Please also tell the compliance contact, so we can pull the records they need.

Part 13: Discipline

What happened	Example	Result
An honest mistake, reported right away	Wrong date on a trip log, caught before billing	Correct it and retrain
Carelessness	A trip log turned in without times or a signature	Written warning and retraining
Repeated carelessness	A second warning within ______ months	Suspension or removal from the schedule
Not reporting fraud you knew about	Seeing a co-worker sign for riders and saying nothing	Written warning, up to termination
Falsifying a record or billing a trip that did not happen	Signing for a rider, adding miles, billing a no-show	Termination and a report to the broker
Retaliating against someone who reported	Cutting a driver’s trips after a report	Termination

The compliance contact records every action taken under this part.

Part 14: Records and review

1. We keep these for at least 10 years, or longer if a contract or law requires it: every version of this policy, signed acknowledgments, training records, screening results, the concerns log and investigation records, the refund log, and discipline records.
2. We review this policy every year, and after any new broker contract, investigation, or refund.

Part 15: Acknowledgment

I have read this policy and was trained on it. I understand what we never do, the laws in Part 7, and how to report a concern. I understand that I will not be punished for reporting in good faith, and that breaking this policy can lead to discipline up to termination.

Name	Role	Date trained	Signature

Who requires a written fraud, waste, and abuse policy

As of October 2026, no federal rule requires a small NEMT company to write this policy just because it bills Medicaid. The duty reaches you through the companies that pay you.

• Medicaid entities paid $5 million or more a year. Social Security Act section 1902(a)(68) makes any entity that receives or makes at least $5,000,000 a year in Medicaid payments set written policies for all employees, contractors, and agents. The policies must explain the False Claims Act, the federal administrative remedies, state false claims laws, whistleblower protections, and the entity’s procedures for detecting and preventing fraud, waste, and abuse, and any employee handbook must discuss them. CMS’s letter to state Medicaid directors of December 13, 2006 (SMDL 06-024) counts a subcontractor that furnishes Medicaid services for the entity as a contractor, and says the entity’s written policies must also be adopted by its contractors or agents.
• Medicaid health plans. Under 42 CFR 438.608, a plan must run a compliance program, verify by sampling or other methods that services its network providers billed were received, and refer potential fraud to the state. It must give network providers a way to report an overpayment and return it within 60 calendar days with a written reason. A plan paid $5,000,000 or more a year under its contract must give the same False Claims Act policies to employees, contractors, and agents.
• Medicare Advantage plans. A plan’s compliance program must have written standards with a policy of non-intimidation and non-retaliation, and confidential lines of communication open to its first tier, downstream, and related entities, with a way to report anonymously (42 CFR 422.503(b)(4)(vi)). A ride company working under a plan’s broker is usually a downstream entity. CMS’s final rule of April 16, 2018 dropped the requirement that these entities take CMS’s compliance course, but it said they still must follow all program rules and that a plan may require training by contract. See first tier, downstream, and related entities.
• OIG’s voluntary guidance. The General Compliance Program Guidance (November 2023) asks even small entities without a formal reporting program to have policies that require good-faith reporting, set out how reports are investigated and resolved, and bar retaliation. Parts 8 to 10 do that.

The definitions in Part 3 follow the federal ones in plain words. Medicaid’s rule defines fraud as an intentional deception or misrepresentation made knowing it could bring an unauthorized benefit, and abuse as practices inconsistent with sound fiscal, business, or medical practices that cause unnecessary cost (42 CFR 455.2). CMS’s provider booklet on fraud and abuse (April 2026) places waste between mistakes and abuse: inefficiency rather than bending the rules.

What brokers add to the policy

Broker agreements turn these rules into specific terms. Examples as of October 2026:

• MTM Health. Its Virginia and Rhode Island handbooks say transportation providers have a fiduciary responsibility to report suspected fraud, waste, and abuse to that hotline, and that providers and drivers take fraud, waste, and abuse training before their first MTM trip and every year after. Its standard agreement, in the January 1, 2023 version Pennsylvania posts, requires you to follow the False Claims Act, the Anti-Kickback Statute, and the Deficit Reduction Act of 2005, and to cover fraud, waste, and abuse in driver training. You warrant that no money or gifts go to MTM staff in exchange for trips, and you must report known or suspected fraud or willful abuse by a member right away. MTM pays nothing for trips by uncredentialed drivers, attendants, or vehicles, and you may not bill members even if MTM does not pay.
• Modivcare. Its 2025 annual training for transportation providers lists provider examples of fraud, waste, and abuse: billing trips that did not occur, billing trips for members who have died, billing a higher level of service than needed, letting a member sign a manifest for a trip that did not happen, and offering anything of value to Modivcare staff or members for more or better trips. Its gift policy bars providers from exchanging anything of value with riders, Modivcare staff, or other vendors without the Compliance Officer’s approval. The 2025 attestation certifies that owners and drivers finished the training for the calendar year and that new staff finish within 30 days of hire. Its attestation page (updated June 10, 2026) asks for the signed form within 90 days, signed by someone with authority to attest. See Modivcare.
• WellTrans. Exhibit D of its Indiana provider agreement (revised October 16, 2025) is a fraud, waste, and abuse policy you must follow and hand to all your employees and contractors. It requires you to have a system for reporting potential violations that includes an anonymous option. The agreement has you warrant that drivers and attendants get HIPAA and fraud, waste, and abuse training at hire and every year, and lets WellTrans end it at once for falsified trip logs or invoices or for offering kickbacks. See WellTrans.
• Alivi. Its downstream provider oversight policy (effective January 1, 2025) has providers sign an attestation before they start and every year. It covers the code of conduct, general compliance and fraud, waste, and abuse training, OIG and SAM screening, and conflicts of interest. Alivi audits at least 5 percent of active downstream providers each year.
• MAS in New York. Its network manual (October 1, 2023) says any exchange, gift, or favor between a Medicaid enrollee and a provider, its driver, or its staff is possible fraud and will be reported to the state Department of Health and the Office of the Medicaid Inspector General.

That last rule is why Part 4 bars gifts to riders outright. Federal guidance allows gifts of nominal value, which OIG reads as $15 per item and $75 a year per person, never cash or a cash equivalent (policy statement of December 7, 2016), but your broker’s rule controls. Anti-kickback rules for NEMT covers referrals from facilities and staff. The examples in Part 4 also track the schemes in CMS’s NEMT booklet for providers (April 2016), which names billing loaded miles for a no-show as a common form of NEMT fraud and tells owners to teach drivers never to embellish their records. The NEMT fraud guide shows how each scheme gets caught.

The rules behind reporting and repayment

No retaliation. The False Claims Act protection in 31 U.S.C. 3730(h) covers employees, contractors, and agents, so it reaches contract drivers as well as staff. A person has 3 years after the retaliation to sue. Modivcare’s and WellTrans’s policies also bar retaliation against anyone who reports to them or to law enforcement.

Investigating. OIG’s guidance asks for a record of every investigation made as it happens: the alleged violation, the steps taken, interview notes and key documents, a log of the witnesses and documents reviewed, the results, and the discipline or corrective action. If, after a reasonable inquiry, there is credible evidence of misconduct that may break the law, OIG says to tell the right government office promptly, no more than 60 days after deciding the evidence is credible. The glossary entry on Medicaid Fraud Control Units explains who investigates at the state level.

Paying back. Federal law requires you to report and return an overpayment, with a written reason, within 60 days after you identify it, and money kept past that deadline becomes an obligation under the False Claims Act (42 U.S.C. 1320a-7k(d)). The 60-day overpayment rule explains when the clock starts and who gets the money.

Answering broker checks. Brokers confirm rides with clinics, and slow answers cost money. WellTrans’s agreement (revised October 16, 2025) says that when a facility reports a rider missed an appointment you billed as completed, no written answer within 30 days of WellTrans’s request counts as confirmation the trip did not occur, and the cost comes out of your next payment. That is why Part 11 has you answer every request by its date.

Where to report outside the company. CMS’s fraud and abuse booklet (April 2026) sends Medicaid providers to the OIG Hotline or to their state Medicaid agency, and notes that anyone can report anonymously. Keep a record of any report you make, as CMS’s NEMT booklet advises.