FWA and HIPAA: Why healthcare must tackle both
2025-08-18 | Blog
Fraud, Waste, and Abuse (FWA) and HIPAA violations may seem like separate issues — one tied to billing integrity, the other to patient privacy. In reality, they are deeply connected, together draining billions from the U.S. healthcare system through fraud losses, regulatory fines and breach costs, while also undermining public trust.
Every diverted dollar or breached record is a missed opportunity to improve care, reduce costs and strengthen confidence in the healthcare system. That’s why tackling both FWA and HIPAA is a business imperative.
What FWA looks like in practice
FWA takes many forms across patient care, billing, administration and procurement. Common examples include:
- Fraud: Billing for services never provided, falsifying diagnoses or accepting kickbacks.
- Waste: Ordering unnecessary tests or procedures or inefficient use of resources.
- Abuse: Charging for services that aren’t medically necessary or misusing billing codes.
These behaviors cost the U.S. healthcare system billions every year to strain already tight budgets and increase costs for patients, providers and payers alike.
The Problem in numbers
FWA is pervasive, and estimates of its financial toll vary widely:
- The National Healthcare Anti-Fraud Association (NHCAA) puts the cost at $68 billion annually
- Commercial health plans place the costs closer to $230 billion annually
- Managed Healthcare Executive estimates the costs to be between $250–$800 billion annually
No matter the figure, the impact is clear: higher insurance premiums, tighter budgets and reduced access to quality care. For HR and compliance leaders, this is more than a financial challenge — it’s about building a culture of ethics, accountability and workforce readiness.
The link between HIPAA and FWA
Many FWA schemes begin with compromised patient data. Protected Health Information (PHI) can be stolen or misused to file false claims, order unneeded services or manipulate billing records. Without strong HIPAA safeguards, organizations leave the door wide open to fraud.
By integrating HIPAA and FWA training, healthcare organizations can reduce risk and strengthen a culture of vigilance.
Why the stakes are higher in 2025
Regulators have made healthcare fraud enforcement a national priority, increasing both visibility and consequences:
- Historic healthcare fraud takedown – On June 30, 2025, DOJ, HHS-OIG, and partners executed the largest-ever “National Health Care Fraud Takedown,” charging 324 defendants in schemes totaling over $14.6 billion.
- False Claims Act enforcement – Federal agencies are zeroing in on Anti-Kickback Statute violations, private equity’s role in healthcare and misuse of AI in federal programs.
- Medicaid overhaul – A June 2025 memorandum directed HHS and CMS to reduce FWA in Medicaid by aligning payment rates more closely with Medicare.
- Efficiency-driven oversight – In just six months, HHS OIG flagged $16.6 billion in overpayments, fraud and potential savings, with $3.5 billion expected to be recovered.
The bottom line: Regulators expect proactive prevention, not just reactive responses. Every employee, from clinicians to billing specialists, plays a role in protecting patient trust and organizational integrity.
5 red flags employees must recognize
Compliance training is most effective when employees know what to look for. Five common warning signs include:
- Unusual Billing Patterns: Multiple claims for the same service, or sudden spikes in billing volume.
- Inconsistent Documentation: Records or test results that don’t match billed services.
- Overuse of High-Cost Services: Ordering expensive tests, imaging or consultations without clear medical need.
- Unauthorized Access to PHI: Accessing patient data outside of one’s role or responsibilities.
- Behavioral Changes: Employees avoiding oversight and resisting audits.
Embedding these scenarios into compliance training helps employees act early before issues escalate.