Medicaid Waste, Fraud, and Abuse: Why CMS’s Improper Payment Rate Can’t Be Trusted

Key Takeaways

Introduction

According to the most recent improper payment report from the Centers for Medicare and Medicaid Services (CMS), the official improper payment estimate for Medicaid is $37.4 billion annually, or 6.12 percent of all Medicaid payments. Some states are pointing to a low CMS improper payment rate as evidence that waste, fraud, and abuse are not a major problem in their state programs. This argument is flawed because the program used to produce this estimate—the Payment Error Rate Measurement (PERM) program—is not designed to measure fraud and contains major gaps that make it misleading.

PERM is a statistical compliance measurement tool required under federal law, while fraud enforcement is carried out through a separate system of audits, investigations, and prosecutions by federal and state entities. These systems serve different purposes and rely on different methodologies, but are often conflated in policy discussions.

The improper payment estimate is crude and does not capture the amount of waste, fraud, and abuse in Medicaid. Most of it is not counted in the improper payment methodology. Moreover, the current improper payment rate is essentially meaningless because of significant gaps in its methodology regarding eligibility and managed care.¹ Given these limitations, PERM is not a good proxy for Medicaid misspending. It is a narrow, lagged audit of a subset of administrative errors.

While the best way to reduce waste, fraud, and abuse is to reform the programs and address perverse incentives at their core, policymakers should also take steps to accurately identify and reduce improper payments. If CMS holds states accountable for improper payments, states will take steps to reduce them, which in turn will reduce waste, fraud, and abuse. But if the federal government continues to use a flawed program that signals that improper payments are low, states will use these numbers as a reason not to invest in program integrity.

Waste, Fraud, Abuse, and Improper Payments Defined

Below are definitions of waste, fraud, abuse, and improper payments. These terms often overlap but are defined and enforced differently under the law.

Fraud

Medicaid regulations define fraud as “an intentional deception or misrepresentation made by a person with the knowledge that the deception could result in some unauthorized benefit to himself or some other person,” including “any act that constitutes fraud under applicable Federal or State law.”² The critical element is intent. Without intent, there is no fraud. Federal fraud statutes reflect this understanding.³ Because fraud requires the finding of intent, it is harder to prove than mere improper payments, which can include honest mistakes by either the payor or the payee.

Waste

Waste has no formal regulatory definition in Medicaid. There are no unique anti-waste statutes, nor does the government seek to track “waste” in a separate way. The Government Accountability Office (GAO) defines waste as “when individuals or organizations spend government resources carelessly, extravagantly, or without purpose.”⁴ In Medicaid, inordinately high spending on some services might be considered a form of waste even if it is not fraudulent. For example, the Wall Street Journal recently reported that one applied behavioral analysis center in Indiana was billing “$640 an hour for routine therapy,” which was “more than 10 times higher than the nation’s average.”⁵ As the center’s founder stated, her company “complied with Indiana’s rules and the state never objected to her prices.” If the center complied with the law, these payments would not be considered fraudulent or improper. After all, the center was providing a service and properly billing for it. They could, however, be considered wasteful, because such extravagant reimbursements reflect the government’s carelessness. The founder herself acknowledged such carelessness, saying, “I don’t think Indiana really had any oversight, or not much.”

Abuse

Abuse is defined in regulation as “provider practices that are inconsistent with sound fiscal, business, or medical practices, and result in an unnecessary cost to the Medicaid program, or in reimbursement for services that are not medically necessary or that fail to meet professionally recognized standards for health care.”⁶ Abuse also encompasses “beneficiary practices that result in unnecessary cost to the Medicaid program.” Regulations require a state agency to refer suspected abuse to fraud control units or conduct a full investigation before referring it to the appropriate law enforcement agency.⁷

Improper Payments

The term improper payment is defined in statute as “any payment that should not have been made or that was made in an incorrect amount under statutory, contractual, administrative, or other legally applicable requirements,” including payments made without sufficient documentation to determine propriety.⁸ Improper payments also include payments to ineligible recipients, payments for ineligible goods or services, duplicative payments, payments for goods or services not received (unless authorized by law), and payments that fail to account for applicable credits or discounts.⁹

This definition is broad enough to capture some waste, fraud, and abuse, but too narrow to capture the full scope of those problems. For example, the excessive reimbursements in Indiana mentioned above would not count as improper payments, because the practice followed the law.

Importantly, improper payments are identified through administrative review—not adjudication—and therefore do not establish wrongdoing. Therefore, an improper payment does not necessarily mean fraud, although it could include some fraudulent transactions.

To address improper payments in Medicaid specifically, the Social Security Act limits federal Medicaid funding by disallowing reimbursement for the portion of a state’s erroneous payments that exceeds a 3 percent error rate.¹⁰ In 2020, GAO noted CMS had not used this authority “for decades.”¹¹ If CMS were to use this authority, it would encourage states to take program integrity measures more seriously.

Medicaid’s PERM Program and Its Gaps

CMS created PERM to comply with federal improper payment laws. It is not designed to identify specific actors or detect fraud. The program is intended to estimate how much Medicaid spending is improper—whether due to eligibility errors, claims processing errors, medical review issues, or insufficient documentation—regardless of intent. PERM’s stratified random sample of approximately 48,000 claims annually represents a tiny fraction of the hundreds of millions of Medicaid claims processed each year.¹² In essence, PERM mostly measures documentation and claim processing compliance.¹³

Each year, CMS uses a sample of Medicaid payments in one-third of states and then includes those findings with findings from the other two-thirds of states reviewed in the previous two years to set a national improper payment rate. PERM measures improper payments across three distinct components, each with separate error rates: (1) state fee-for-service (FFS) payments, (2) state capitation payments to managed care organizations (MCOs), and (3) eligibility.

As a result, PERM is a partial, incomplete, and misleading measure that is in dire need of updating.

Current Improper Payment Rate Includes Irrelevant Information

PERM’s failure to accurately capture eligibility is the program’s biggest gap.

In a 2025 policy brief, Brian Blase and Rachel Greszler showed how improper payments in Medicaid far exceeded the official estimates because PERM stopped capturing eligibility errors.¹⁴ Both the Obama and Biden administrations stopped conducting eligibility checks. The Obama administration claimed that states would need flexibility as they adopted Medicaid expansion. The Biden administration, citing COVID-19, required states to stop checking eligibility and similarly stopped checking eligibility under PERM.¹⁵

When PERM has measured eligibility, the improper payment rate explodes. In the two years (2019 and 2020) when full eligibility reviews were conducted in one-third of states, the improper payment rate averaged 27 percent.¹⁶ Eligibility errors comprised an average of 80 percent of all errors. Applying a 25 percent improper payment rate to all federal Medicaid spending from 2015 to 2024 means that $1.1 trillion of federal Medicaid spending was improper. The figure, reproduced from Blase and Greszler’s paper, shows the official improper payment rate and the percentage of audits that included eligibility reviews. It shows the national improper payment rate in excess of 21 percent in the two years in which two-thirds of states had their eligibility reviews conducted. When eligibility reviews were not a component of PERM, the improper payment rate was much lower—but also meaningless.

Improper spending was driven, in part, by states’ strong incentive to classify enrollees as eligible under the Affordable Care Act’s Medicaid expansion, because they receive much more federal funding—an average of $7 more for each $1 of state spending—on expansion enrollees than on traditional enrollees.

This year, eligibility is still a major gap. There are two major reasons PERM numbers continue to understate eligibility errors.

First, even though CMS says that PERM has resumed eligibility redeterminations following the COVID-19 public health emergency, which ended in May 2023, PERM is based on a rolling three-year average, so the latest 2025 number includes sample months in which states were not conducting eligibility reviews.¹⁷

Second, many states still have waivers to extend the pandemic-era loosening of audits, which will continue to make their eligibility error rates unreliable. While states were required to start checking eligibility again in 2023, Congress allowed many states to receive waivers to continue their “continuous enrollment” policies.¹⁸ During the pandemic, CMS stated that it would not treat states’ delays in eligibility and enrollment actions as “untimely for purposes of” PERM and that eligibility determinations conducted in accordance with approved flexibilities would not be considered out of compliance under PERM.¹⁹ Subsequent CMS guidance continued to allow states to delay and modify eligibility processes.²⁰ As of December 2024, CMS had approved waivers for 49 states²¹ (all except Florida), and as of January 2025, most states continued to use at least one waiver under this authority.²² Once those waivers expire, the PERM will likely increase substantially.

Because the current PERM rate reflects years when eligibility checks were suspended or relaxed, it still understates eligibility errors. Even as redeterminations resume, the rolling three-year average continues to incorporate periods with little oversight, making the current estimate an unreliable measure of eligibility-related improper payments.

PERM Does Not Examine Managed Care Claims at the Provider Level

PERM is also limited because it does not meaningfully examine the largest portion of Medicaid. More than two-thirds of Medicaid enrollees are enrolled in managed care plans, in which states make capitated payments to MCOs.²³ These payments are fundamentally different from FFS claims. While FFS pays for each discrete service, states send MCOs monthly per-member payments to manage and pay for enrollees’ care. If an MCO spends less than the capitated payment, it can keep the savings.

PERM does not examine managed care claims at the provider level.²⁴ Instead, it evaluates whether states made correct capitation payments to MCOs based on contract terms. It does not assess the payments that MCOs make to providers for specific services.²⁵ As a result, PERM reviews do not include meaningful audits of spending within managed care. This gap helps explain why PERM’s managed care claims error rate is near zero almost every year.²⁶

That minuscule error rate does not mean that managed care is error-free; rather, it reflects a failure of the PERM program. GAO reported in 2025 that PERM’s MCO gap means that the program misses multiple errors, such as payments to ineligible providers, payments for services not delivered, or payments for duplicative services.²⁷ GAO further noted that when the Department of Health and Human Services Inspector General conducted more granular audits into MCO payments, it found multiple errors.²⁸ The audits indicate that if PERM were to examine MCO provider payments, its MCO claims error rate would likely be much higher.

In theory, MCOs should limit fraud, because they have an incentive under the capitation model to use tools such as prior authorization to review and deny claims and act against billing pattern anomalies. But that is not always the case. Increasing vertical integration between plans and providers²⁹ may weaken MCOs’ incentives to ensure that payments are economical and efficient. For example, if MCOs grant related-party providers³⁰ more favorable terms than those for non-related providers, they can still indirectly benefit, because the money stays in the same corporate structure.³¹

Given these incentives and gaps, PERM’s failure to examine spending within MCOs is a major flaw that makes its findings unreliable.

Conclusion

Currently, states have weak incentives to reduce improper payments, because higher spending can generate additional federal matching funds.³² PERM is not designed to measure fraud and falls short of its intended purpose of identifying improper payments due to significant gaps in its methodology. As a result, its reported rates should not be taken at face value as a measure of Medicaid improper payments or the extent of waste, fraud, and abuse.

To address these shortcomings, CMS should take a more comprehensive approach to strengthening PERM so that it better reflects the true scope of improper payments. That means improving how the program measures errors, reducing delays in reporting, and increasing review frequency. This could serve as a useful benchmark for whether states’ integrity measures are effective—and as the legal basis for CMS to conduct disallowances as required under Section 1903. Such efforts are paramount to incentivize states to put in place proper guardrails to prevent all improper payments—regardless of intent. With these reforms, PERM would give CMS a stronger foundation to enforce program integrity requirements and prevent improper payments before they occur rather than reacting after the fact.

In the meantime, no one should take PERM’s low improper payment rates as the true measure of waste, fraud, and abuse in state Medicaid programs. They are deficient because they contain major gaps—particularly related to eligibility and managed care—that risk giving a false sense of confidence about Medicaid’s program integrity.

Footnotes