How to report Medicaid transportation fraud: hotlines, fraud units, and whistleblower rules

There are four places to report suspected fraud in a Medicaid ride: HHS-OIG’s hotline, the Medicaid Fraud Control Unit in your state, your state’s Medicaid agency or its inspector general, and whichever broker or health plan arranged the ride. Any of them can start a review, and the government agencies pass cases to each other. The OIG hotline takes calls at 1-800-HHS-TIPS (1-800-447-8477) and tips online at tips.oig.hhs.gov.

This guide is for anyone who sees the problem up close: riders and families, drivers and dispatchers, facility staff who book rides, and owners who watch a competitor bill trips that never happen. The schemes themselves, and how a company guards against them, are covered in the guide to NEMT fraud prevention.

What is worth reporting

Report billing that does not match the ride. Medicaid pays for a specific trip by a specific vehicle type over specific miles, so fraud usually shows up as a gap between the claim and what actually happened:

• Rides that never happened, or a no-show billed as a completed trip. CMS’s NEMT booklet says billing loaded mileage for a rider who never showed is common and illegal, and that the False Claims Act can reach it.
• Billing a costlier service level than the ride, for example a wheelchair van rate charged for a rider who walked out to a sedan.
• Padded miles or tolls, where the billed route is longer than any route between the two addresses.
• Payments or gifts to riders for choosing a company, or to anyone for steering trips. OIG lists kickbacks and inducements for referrals among the Medicare and Medicaid complaints it investigates.
• Unqualified or excluded drivers billed as if they met the program’s requirements.
• Riders’ Medicaid numbers used without their knowledge, which OIG treats as medical identity theft.

Some complaints belong elsewhere. A late pickup, a rude driver, or a dirty van is a service complaint for the broker or health plan, not a fraud tip. OIG points privacy complaints to HHS’s Office for Civil Rights, and it advises anyone after a refund or other personal relief to pursue other remedies.

Where to report

Each of the four doors handles fraud differently, and a serious case usually reaches more than one of them. The table shows what each is best at.

The HHS-OIG hotline takes false or fraudulent claims to Medicare or Medicaid, kickbacks for referrals, and medical identity theft. Besides the online form and phone line, it accepts mail at HHS OIG, Attn: OIG Hotline Operations, P.O. Box 23489, Washington, DC 20026, and offers TTY at 1-800-377-4950.

The state Medicaid Fraud Control Unit brings cases against providers who defraud Medicaid, and cases where Medicaid patients are abused or neglected. Every state has one, as do Washington, D.C., Puerto Rico, and the Virgin Islands, usually inside the attorney general’s office. OIG posts a directory of unit directors with phone numbers and addresses, dated October 1, 2026.

The state Medicaid agency is required to pass all suspected provider fraud to the state’s fraud unit (42 CFR 455.21), so a report to the agency does not stall there. Examples of state lines: New York’s Office of the Medicaid Inspector General takes fraud reports at 1-877-87-FRAUD (1-877-873-7283), Maine’s MaineCare program integrity unit at (866) 348-1129, and Kansas points provider fraud reports to the attorney general’s Medicaid Fraud and Abuse Division at 866-551-6328 or 785-368-6220.

The broker or health plan can act fastest on a single company, because it controls the trip assignments. Modivcare’s 2025 provider training tells transportation providers to report known, suspected, or potential fraud, waste, and abuse to their provider relations contact or its Ethics and Compliance Hotline, run by a third party, at 855-818-6929 or ethicshotline.modivcare.com. MTM’s Pennsylvania provider agreement says MTM or its client investigates suspected fraud by a provider or its drivers and notifies government authorities where appropriate. Health plans in Medicaid managed care must also pass on what they find: potential fraud, waste, or abuse to the state’s program integrity unit, or potential fraud straight to the fraud control unit (42 CFR 438.608).

Which door to use first

Start with the door closest to the evidence, then add a government agency if the problem is more than one ride.

1. A rider or family member who was billed for a ride that never came should call the broker or health plan that books their rides, then file with the OIG hotline.
2. A driver, dispatcher, or biller who sees fraud inside their own company can use the company’s compliance contact if the owner is not involved. If management is part of it, go straight to the OIG hotline, the state fraud control unit, or a lawyer.
3. Facility staff who book rides and notice trips the patient never took should tell the broker and the OIG hotline, with the appointment dates from the facility’s own records.
4. A rival owner who suspects a competitor is billing phantom trips should file with the fraud control unit or the OIG hotline, and talk to a lawyer before filing anything in court.

CMS’s NEMT booklet notes that most states run a preliminary investigation before sending a case to the fraud control unit, and that some require reports to go to the Medicaid agency and the unit at the same time. Keep a dated note of every report you make and who you made it to.

What to put in the report

A report gets investigated when it names who, what, when, and how you know. OIG asks for four things:

1. The name and contact details of the person or business involved, with addresses, phone numbers, and email addresses if you have them.
2. A short account of what happened, how widespread it is, the time frame, and how you learned about it.
3. Anyone who can back it up, with their contact details.
4. Supporting evidence in electronic form, such as emails, documents, billing records, or photographs.

For a ride, the details that make a tip checkable are the dates and times, the pickup and drop-off places, the vehicle and its plate or company markings, the driver’s name, and what was billed or signed. An example of a useful line: on three named dates in June, the rider was in the hospital, yet the company’s driver logged round trips to her dialysis center.

Do not mail originals; OIG will not return them, and it will not accept flash drives or other digital media by mail.

Drivers and office staff often worry that sharing trip details breaks privacy rules. Under the HIPAA whistleblower provision, 45 CFR 164.502(j), an employee or other workforce member acting in good faith on a belief that the employer is breaking the law may disclose protected health information to a health oversight agency or to their own attorney. Share what the report needs and nothing more.

Staying anonymous or confidential

You can report without giving your name, but it costs something. OIG offers three choices:

• No restrictions. OIG may share your identity with others outside OIG who need it, and you can revoke that later if an agent contacts you.
• Confidential. OIG keeps your identity inside OIG, though it may still disclose it if the investigation or the law requires.
• Anonymous. You give no identifying details. OIG cannot then treat the matter as a whistleblower retaliation complaint, and it may be harder to resolve.

Modivcare’s hotline also takes anonymous reports through its third-party operator. If you expect pushback at work, giving OIG your name, even confidentially, keeps a retaliation complaint open as an option later.

Filing a whistleblower case and the share it can pay

A person with inside knowledge of fraud against Medicaid can file a qui tam lawsuit under the False Claims Act and share in what the government recovers. The rules in 31 U.S.C. 3730 shape the case:

• The filing is secret at first. The complaint is filed under seal for at least 60 days and served on the government with a written disclosure of substantially all the evidence. The company is not served until the court orders it.
• The share depends on the government’s choice. If the government takes over the case, the filer gets 15 to 25 percent of the proceeds. If it declines and the filer carries the case alone, 25 to 30 percent. When the government takes a case that rests mainly on information already public through a hearing, an official report, or the news, the court can award no more than 10 percent.
• The first filer holds the claim. While a case is pending, no one but the government can bring a related case on the same facts.
• Public information can sink a case. A court must dismiss a case built on allegations already disclosed publicly unless the government opposes, or the filer is an original source with independent knowledge.
• Taking part in the fraud costs you. A filer who planned and started the fraud may have the share reduced, and one convicted of criminal conduct for it is dismissed with no share.

Many states have their own false claims acts. OIG has approved 24 of them as close enough to the federal law to earn the state a bigger share of Medicaid recoveries, most recently Louisiana’s on February 20, 2026. A qui tam case is filed in court, so it starts with a lawyer, not a hotline.

Protection from getting fired for it

The False Claims Act shields employees, contractors, and agents from retaliation for lawful efforts to stop a violation. Relief includes reinstatement, twice the back pay with interest, and special damages, and the claim must be filed within three years of the retaliation. The guide to retaliation laws that protect drivers covers that claim and the other laws that apply, such as OSHA’s 30-day window for safety complaints.

When the problem is inside your own company

An owner who finds fraud in their own billing has different duties. Stop billing the affected trips, keep every record, and work out what was overpaid, because the 60-day overpayment rule sets a deadline for returning Medicaid money you were not owed. The fraud prevention guide covers the response step by step.

Records that answer an investigator’s questions

A fraud review asks what happened on each billed trip. In HealthRide, each trip keeps a timestamp for pickup and for drop-off, its GPS-recorded mileage, and either the rider’s on-screen signature or the recorded wait on a no-show. Reports export the full trip log to CSV or PDF. An owner can check a disputed trip against that record before deciding whether something needs to be reported or repaid.