Fraud, waste, and abuse policy template for a ride company: what you never bill, how to report, and repayment

This is a written fraud, waste, and abuse policy a ride company can adopt and hand to a broker, health plan or auditor who asks how it keeps false billing out. Copy the template, fill in the brackets, and have the owner sign it. The definitions and the schemes investigators find are in the fraud, waste, and abuse entry and the fraud prevention guide. The seven-part program that a policy like this sits inside is in building a NEMT compliance program. This page is the policy and nothing around it.

Does a ride company need a written fraud, waste, and abuse policy?

Federal law requires one in writing from any entity that receives or makes at least $5 million a year in payments under a state Medicaid plan or waiver, and the policy has to reach that entity’s contractors and agents. A smaller ride company may be held to it through a broker or plan contract. Section 6032 of the Deficit Reduction Act of 2005 added the rule as section 1902(a)(68) of the Social Security Act. It asks for written policies, for every employee including management and for any contractor or agent, that give detailed information about:

• the federal False Claims Act, 31 U.S.C. 3729 through 3733;
• the administrative remedies for false claims and statements in chapter 38 of title 31;
• any state law with civil or criminal penalties for false claims and statements, and the whistleblower protections under it;
• the part those laws play in preventing and detecting fraud, waste, and abuse in federal health programs.

The same policies must hold detailed provisions on how the entity detects and prevents fraud, waste, and abuse, and any employee handbook must discuss the laws, the whistleblower rights and those procedures. CMS’s 2006 letter on the rule (SMDL #06-024) fills in who is covered:

• Counting the $5 million. All payments the entity receives or makes under the state plan or a waiver, added across locations, contracts and tax ID numbers. A managed care organization counts as an entity. The test is set each January 1 from the preceding federal fiscal year.
• Contractors and agents. Any contractor, subcontractor or agent that, on the entity’s behalf, furnishes or authorizes Medicaid items or services, does billing or coding, or monitors care. The entity’s policies must also be adopted by them.
• Form. Paper or electronic, readily available to every employee, contractor and agent. No handbook has to be created if there is none. CMS gave no model language.

A carrier moving a broker’s riders can fit the contractor description, so read the contract for a clause that makes you adopt the broker’s version, and ask the broker whether the rule applies to you. The compliance program guide lists what the large brokers ask for in training and attestations. OIG’s 2023 compliance guidance adds a floor for any small entity without a formal hotline: written policies that tell staff to report possible violations in good faith, describe how a report is investigated, and forbid retaliation.

How to use this template

The owner fills in each bracket, has an attorney review the wording, and adopts it with a date. Then the policy goes to every employee, contractor and subcontractor, in a form they can reach at any time.

• Handbook. If you have an employee handbook, add a short section that points to this policy. The law asks the handbook to discuss the false claims laws and whistleblower rights (sections 7 and 12) and how the company detects and prevents fraud, waste, and abuse (sections 3 to 6).
• Optional lines. The bracketed sentence in section 6 that makes failing to report a violation itself a violation is optional, an idea from OIG’s guidance for small entities. Cut it if you disagree.
• Signatures. File each signed acknowledgment with the person’s training record.
• State law. Section 12 has a blank for your state’s false claims law. Fill it in before you issue the policy.

The template

[Company name] fraud, waste, and abuse policy

Effective date: [date] Approved by: [owner name] Compliance contact: [name, role, phone]

1. Purpose and who it covers

[Company name] is paid with public money for rides that happened as billed. This policy tells everyone who works for us what we never bill, how to report a concern, and what we do when we find a mistake. It covers every owner, manager, dispatcher, driver, attendant and office employee, and every contractor or subcontractor who works on our trips or our billing.

2. Definitions we use

• Fraud is an intentional deception or misrepresentation made knowing it could win someone a benefit they have no right to.
• Abuse is a practice that does not fit sound business practice and costs a program money, or gets paid for a service that was not medically necessary, even when no one meant to deceive.
• Waste is the overuse or misuse of resources that costs a program money, usually without a crime, such as keeping a standing order running after the rider no longer needs the ride.

3. What we never bill or record

We bill only trips that happened as recorded. We never:

• bill or record a trip the rider did not take, including a no-show and a trip the rider cancelled;
• bill loaded miles for any part of a trip when the rider was not in the vehicle;
• bill a trip for a rider who has died;
• bill a higher level of service, vehicle or attendant than we provided, including a trip booked at a higher level and run at a lower one;
• bill a trip to a place the program does not cover, such as a store or a friend’s home;
• bill wait time, extra stops or add-ons that the payer’s rate sheet does not pay;
• bill a trip run by a driver, or in a vehicle, that was not credentialed on the date of the trip;
• ask a rider to sign for a trip that did not happen, or sign for a rider;
• use a rider’s name or ID number for a trip that rider did not take;
• give or take anything of value in return for trips or referrals. [Section 2 of our code of conduct says more.]

4. How we record trips

• The driver records pickup and drop-off times, the miles driven with the rider on board, and the rider’s signature when the payer requires one, at the time of the trip.
• No one changes a time, a mileage figure or a signature after the fact. A real correction is made by [role], with the reason and the date written beside the original entry.
• Falsifying a trip record is grounds for termination.

5. How we check ourselves

• Each month, [compliance contact] picks [number] paid trips at random and matches each to its record, its miles, its signature, and the driver’s and vehicle’s credentials on that date. For some of them we call the rider or the facility to confirm the trip happened.
• Before we hire or contract with anyone, and every month after, we check each employee, driver and contractor against the OIG exclusion list, SAM.gov and [state exclusion list]. We never use an excluded person for work that a federal health care program pays for. Results go in our screening log.

6. Who to tell when something looks wrong

• Anyone who sees or suspects something wrong, or is asked to do something this policy forbids, reports it right away. You do not have to ask your supervisor first.
• Report to [compliance contact, phone], to [owner, phone], or through [anonymous drop box or hotline]. You may report without giving your name. We keep your name private as far as we can, though in some cases it may have to be revealed.
• You can also report directly to the HHS Inspector General hotline, 1-800-HHS-TIPS (1-800-447-8477), or to [state Medicaid fraud line and number]. These numbers are posted [where].
• [Optional: Failing to report improper conduct you know about is itself a violation of this policy.]

7. Retaliation is never allowed

We will not fire, demote, suspend, threaten, harass or otherwise treat anyone differently for a report made in good faith, or for refusing to do something this policy forbids. The federal False Claims Act also protects employees, contractors and agents from this. Anyone who retaliates faces discipline, up to and including termination. If you think you have been retaliated against, tell [compliance contact], [owner], or the OIG hotline.

8. How we look into a report

• [Compliance contact] writes down the report the day it arrives, secures the records involved (trip logs, GPS data, messages and billing), and decides within [number] business days who will look into it. A person under review may be taken off the work involved until the review ends.
• The investigation record holds the allegation, the steps taken, interview notes and key documents, who was interviewed, the result, and any discipline or fix.
• We cooperate fully with any broker, health plan, state agency, Medicaid Fraud Control Unit or federal investigator, and we give them the records they ask for by the date they ask.

9. Returning an overpayment

• If we learn we were paid for something we were not owed, we stop billing it that way, work out the amount, and return it with a written reason within 60 days after we identify it. [Owner] approves each repayment. We send it to the broker, plan or agency that paid us, through its overpayment process.
• We do not wait for a payer to find an overpayment, and we do not hold one back while we decide what to do.
• Possible fraud goes to [owner] and [attorney] before any disclosure is made.

10. Records and outside audits

• We keep trip records, billing records, driver files and training records for [number] years, or longer if a contract requires it.
• We let [brokers, health plans, the state, CMS and OIG] review our records and vehicles, with or without notice where a contract allows.

11. Training

Everyone takes this policy and fraud, waste, and abuse training within [30] days of starting and every year after. We keep a signed record with the date and the topics.

12. The laws behind this policy

• Federal False Claims Act (31 U.S.C. 3729 through 3733). A person who knowingly submits a false claim for payment, makes or uses a false record or statement material to a false claim, or knowingly and improperly avoids paying money owed to the government is liable for three times the government’s damages plus a civil penalty for each claim. For penalties assessed after July 3, 2025, the penalty is $14,308 to $28,619 per claim, and it is adjusted for inflation. “Knowingly” includes deliberate ignorance and reckless disregard of the truth, and no intent to defraud has to be proven. A person with knowledge of fraud may file a lawsuit on the government’s behalf and may receive part of what is recovered.
• Administrative remedies (chapter 38 of title 31). A person who submits a claim they know or have reason to know is false, or that is for services not provided as claimed, can face a civil penalty for each claim plus an assessment of up to twice the amount of the claim.
• State law. [Name your state’s false claims act and any state law with civil or criminal penalties for false claims and statements, and describe each in one sentence.]
• Whistleblower protection. The False Claims Act protects an employee, contractor or agent who is fired, demoted, suspended, threatened, harassed or otherwise discriminated against for lawful efforts to stop a violation. Relief includes reinstatement, two times the back pay with interest, and special damages. [Add the protections in your state’s law.]
• How these laws help. They give the government and whistleblowers ways to find and recover money lost to false billing, and they give us every reason to find and fix our own errors first.

13. Acknowledgment

I received and read the [Company name] fraud, waste, and abuse policy dated [date]. I understand it and will follow it.

Name: [printed name] Role: [role]

Signature: [signature] Date: [date]

Where each part comes from

The sections that rest on a federal rule, on CMS or OIG guidance or on a broker document are listed here, so the owner can check each source before adopting the policy.

• Section 2. Fraud and abuse follow the Medicaid definitions in 42 CFR 455.2. Waste follows CMS’s Medicare Managed Care Manual (chapter 21), because the Medicaid rule does not define it.
• Section 3. CMS’s Medicaid NEMT booklet for providers (April 2016) names billing loaded miles for a no-show, billing trips to places the program does not cover, billing taxi rides as ambulette trips, and falsifying drivers’ training records. Modivcare’s 2025 training adds trips for members who have died and manifests signed for trips that did not happen. MTM’s Pennsylvania agreement says no payment is made for trips by uncredentialed drivers or in uncredentialed vehicles.
• Sections 4 and 5. The booklet’s tips: records that are complete and accurate, discipline up to termination for falsifying them, management verification by random calls, and exclusion checks before hire and every month.
• Sections 6 and 7. OIG’s 2023 guidance for small entities: everyone knows whom to turn to, a way to report that can be anonymous where possible, a note that identity may come out, no retaliation, and the OIG hotline posted in common areas.
• Section 8. OIG’s guidance on keeping a contemporaneous investigation record and removing people from the work when their presence could compromise the review, and MTM’s clause on cooperating with fraud investigations.
• Section 9. The 60-day rule in 42 U.S.C. 1320a-7k(d) and the plan-level rule in 42 CFR 438.608(d)(2). The 60-day overpayment guide covers when the clock starts.
• Section 12. The paragraphs the law lists at 42 U.S.C. 1396a(a)(68), with current text from the False Claims Act, the Program Fraud Civil Remedies Act and the federal penalty table. OIG has approved 24 state false claims acts for the federal incentive, and its list shows whether yours is one.

Backing the policy with trip records in HealthRide

Two lines in this policy rest on records HealthRide already keeps. A no-show is recorded with the wait time, which shows the trip was a no-show and not a ride to bill. And an expired driver credential is flagged when someone tries to assign that driver a trip, which supports the rule against billing trips run by someone who was not credentialed. The trip log in reports and the credential dates on the fleet page give the monthly check in section 5 something to match against.