14.1 Detecting & Reporting FWA

Why This Topic Matters on the AHIP Exam

Module 5 (Fraud, Waste & Abuse plus General Compliance) carries 20% of the AHIP final, and detection-and-reporting questions are the single most common question type inside that module. AHIP does not just ask you to define fraud, waste, and abuse (FWA) in the abstract (that was Chapter 12); it tests whether you know what to do when you see it: who counts as an FDR, what your personal duty is, which indicators should make you suspicious, where a report goes first, where it goes if the plan itself is the problem, and what protections exist for the person who reports. Get the "who do I call" chain wrong on exam day and you will miss several of the highest-value points in Module 5, because nearly every scenario question in this module is built around exactly that chain.

Where You Fit In: Sponsors and FDRs

Every person who touches a Medicare Part C or Part D enrollee's health or administrative services falls into one of four roles defined by the Centers for Medicare & Medicaid Services (CMS):

Collectively, first-tier, downstream, and related entities are abbreviated FDRs. As an agent, you are almost always a downstream entity, which means the Sponsor's FWA policies, training requirements, and reporting obligations legally flow down and apply to you even though you never signed a contract with the Sponsor directly.

Your Three Personal Duties

CMS assigns every Sponsor employee and FDR the same three duties, and AHIP tends to test all three as a set:

1. Comply with all applicable statutory, regulatory, and Part C/D requirements, including using an effective compliance program (see 14.2).
2. Report any compliance concern or suspected/actual FWA violation you become aware of, even if you were not personally involved and even if you are not certain it is a violation.
3. Follow your organization's Code of Conduct, which states the organization's commitment to ethical behavior "from the top of the organization to the bottom."

The exam trap here is assuming reporting is optional or discretionary "if you're sure." It is not: failure to report can itself trigger discipline, up to termination of your contract or employment, independent of how the original FWA turns out to be resolved.

Recognizing FWA: Key Indicators by Role

You do not need to be a forensic auditor to detect FWA; you need to notice red flags and escalate them. AHIP scenario questions typically hand you a specific role and ask which behavior is a warning sign:

• Beneficiary-related: identical prescriptions filled at multiple pharmacies from different doctors; a beneficiary's medical history that doesn't support the services billed; signs the person receiving services isn't the actual beneficiary (identity theft).
• Provider-related: billing for services never rendered; prescribing a much higher quantity than medically necessary; a diagnosis code with no support in the medical record.
• Pharmacy-related: billing a Pharmacy Benefit Manager for prescriptions never picked up; substituting generics while billing for brand; diverting drugs meant for a nursing home or hospice elsewhere.
• Sponsor-related: encouraging inappropriate risk-adjustment diagnosis submissions; using unlicensed agents; misleading a beneficiary about the true cost of benefits.

Reporting: Internal First, External When Warranted

Every Sponsor is legally required to maintain a mechanism for reporting FWA, typically a Special Investigations Unit (SIU) and/or a dedicated FWA Hotline, and must accept anonymous reports with a firm non-retaliation guarantee: a Sponsor may never discipline you for a good-faith report, even if the investigation later finds no wrongdoing.

When you report, whether internally or externally, include:

• Contact information for the source, suspect(s), and any witnesses;
• Details of the alleged FWA;
• The specific Medicare rule allegedly violated;
• Any history of prior compliance issues, training, or communication involving the suspect.

If the concern involves the Sponsor itself, or the internal channel is unavailable or feels inadequate, you can escalate externally:

A related but distinct pathway is the Self-Disclosure Protocol (SDP): if a Sponsor or FDR discovers its own past FWA, it can voluntarily disclose it to the OIG under the SDP rather than wait for a government-directed investigation. Self-disclosure typically results in a lower settlement than an OIG-initiated audit or investigation because it demonstrates good faith and cooperation, and it avoids the cost and disruption of a government-directed inquiry.

Exam Scenario

An agent overhears a provider's office staff joking about billing Medicare for appointments patients "no-showed." The correct action is not to confront the office, ignore it, or wait for proof; it is to report the suspicion to the agent's own Sponsor compliance department or FWA hotline, anonymously if preferred, including whatever specific details are known. The agent does not need certainty. A good-faith suspicion is enough, and the agent is protected from retaliation for reporting it.

Key Takeaways

• Sponsors, first-tier, downstream, and related entities are collectively FDRs; agents are almost always downstream entities.
• Every Sponsor employee and FDR has three duties: comply, report, and follow the Code of Conduct. Reporting is mandatory, not optional.
• Report internally first (SIU, compliance department, or FWA hotline); escalate externally to the OIG (1-800-HHS-TIPS), PPI MEDIC (1-877-7SafeRx), or CMS when warranted.
• Anonymous reporting must be accepted, and non-retaliation protection applies regardless of the investigation's outcome.
• The Self-Disclosure Protocol lets a Sponsor voluntarily report its own past FWA to the OIG for reduced exposure.