Most health care waste is honest. That is not a comfortable sentence for anyone who works on fraud, waste and abuse, because the 3 words usually travel together and the first one gets the attention. But the numbers point the same way every year, and the agency that publishes them says so directly.
In January, CMS released its improper payment estimates for fiscal year 2025.
| Program | Improper payment rate | Estimated amount |
|---|---|---|
| Medicare fee-for-service | 6.55% | $28.83 billion |
| Medicare Advantage | 6.09% | $23.67 billion |
| Medicare Part D | 4.00% | $4.23 billion |
| Medicaid | 6.12% | $37.39 billion |
| Children’s Health Insurance Program | 7.05% | $1.37 billion |
From the CMS fiscal year 2025 improper payments fact sheet (January 2026).
Together, the 5 programs account for about $95.5 billion. Those figures are often quoted as if they were a fraud tally. CMS’s own fact sheet says otherwise, noting that “improper payment measurement is not a measure of fraud, and not all improper payments are attributable to fraud or abuse.” In Medicaid, CMS attributed 77.17% of improper payments to insufficient documentation.
What the numbers measure
An improper payment is one that should not have been made or was made in the wrong amount. It also includes a payment that cannot be shown to be correct, and that category does most of the work. When a reviewer pulls a sample claim and the record lacks a signed order or a required form, the payment counts as improper. The service may well have been delivered and needed. The measurement cannot tell, so it counts the gap.
That is a reasonable way to measure payment accuracy. It is a poor way to measure intent. A missing signature and a billed service that never happened land in the same total.
The broader picture of waste looks similar. In a widely cited 2019 study in JAMA, researchers estimated that waste in the US health care system cost $760 billion to $935 billion a year, about a quarter of total spending. They put fraud and abuse at $58.5 billion to $83.9 billion. Administrative complexity alone came to $265.6 billion, with pricing failures close behind.
Fraud is real, and tens of billions of dollars is not a rounding error. But in both estimates, the larger share of the money is lost to systems that are hard to use correctly, not to people trying to steal.
Treating every error as fraud has costs
A program that reads every anomaly as possible fraud pays for that view in 3 ways.
- It spends investigator time on paperwork. Every audit of a practice that forgot a form is time not spent on the billing scheme that invented patients.
- It teaches providers to hide errors. When a correction invites suspicion, the safest course is to say nothing. The data gets worse, and so does the next round of measurement.
- It burns trust that payment integrity depends on. Providers who feel accused for honest mistakes are less likely to fix problems voluntarily or flag something that looks wrong.
None of this argues for looking away. It argues for sorting. Honest error and deliberate fraud need different responses, and a program that gives both the same response does neither well.
An error that happens the same way 1,000 times is not 1,000 frauds. It is one design flaw.
Design the error out
CMS already uses this logic in places. Under its Targeted Probe and Educate program, a Medicare contractor reviews a small sample of a provider’s claims and offers one-on-one education on the errors it finds. It can repeat that for up to 3 rounds before considering a referral for further action. The premise is that most providers who make errors will stop once they understand them.
The same premise can move earlier in the process, before a claim is ever paid.
- Say what is required before the service. Documentation rules that a provider learns about only during a post-payment audit are rules designed to be broken. Requirements should be visible at the point of ordering, which is what electronic coverage requirements discovery is meant to do.
- Check completeness at submission. A missing order or signature caught when a claim or request arrives costs a message. Caught 18 months later in an audit, it costs a recoupment and often an appeal.
- Code the reason for every error. “Insufficient documentation” is a category, not a diagnosis. A useful code names the missing document and the service it was needed for. Coded reasons turn a pile of findings into a short list of fixes.
- Send patterns back to the source. When one practice misses the same element again and again, the first step is to tell them, specifically. When a pattern persists after that, or when the pattern itself suggests intent, it belongs with investigators.
That last step is where the separation pays off. Once the honest errors are handled by design and education, what remains is a smaller set of cases that deserve real investigative attention, and investigators who have time to give it.
What we build for
We build tools that health plans use in utilization review, and the same distinction shows up there. Many requests that end in a denial or a delay do not fail on medical necessity. They fail because a document is missing or a note is out of date. Treating those requests as if they were weak clinical cases wastes everyone’s time.
We think a review should tell the requester exactly what is missing at the start. It should also keep missing documentation separate from a clinical judgment that a service is not needed, with a coded reason for every outcome. That separation is what lets a plan see whether its problem is a policy that providers cannot follow or a provider that does not want to.
It also fits the rules we hold ourselves to. A machine can say yes. Only a person can say no. Every recommendation shows its reasons, and every decision can be reconstructed. A program built that way can answer the question that matters most in payment integrity, which is whether an error was a mistake or a choice.