$37.4 Billion in Improper Payments

What Are Improper Payments?

Every three years, CMS measures each state's Medicaid error rate through the Payment Error Rate Measurement (PERM) program. Federal contractors pull random samples of claims and eligibility determinations, then check whether payments were made correctly — right amount, right person, right documentation.

A payment is “improper” if it was the wrong amount, went to an ineligible recipient, wasn't supported by sufficient documentation, or was otherwise not in compliance with program rules. States are measured on a rotating three-year cycle, with roughly 17 states reviewed each year.

Here's the critical nuance: improper does not mean fraudulent. The vast majority of improper payments are paperwork failures — a missing signature, an incomplete form, a provider who didn't submit documentation in time. The payment may have been for a legitimate service delivered to an eligible patient. It just couldn't be fully verified.

That said, a system that can't verify $37.4 billion in payments is a system that can't tell you how much of that $37.4 billion was actually stolen.

The Numbers: FY2024 vs FY2025

The trend is moving in the wrong direction. Here's what the last two years look like:

A 20% jump in one year. Total Medicaid spending grew too, but not by 20%. The error rate itself climbed from 5.09% to 6.12% — meaning the system is getting worse at processing payments correctly, not just spending more.

The Documentation Problem

Of all improper payments identified, 79.11% were classified as “insufficient documentation.” Not overpayments. Not payments to ineligible people. Just — the paperwork wasn't there.

This is simultaneously reassuring and deeply frustrating. Reassuring because it suggests most of the $37.4 billion wasn't outright theft. Frustrating because after decades of reform efforts, nearly 4 out of 5 errors are still just missing paperwork.

The documentation problem creates a convenient fog. When you can't verify a payment, you can't distinguish a legitimate service with sloppy records from a fabricated claim with no records at all. The 79.11% “insufficient documentation” bucket is where confirmed fraud hides — because the whole point of the category is that nobody checked.

Recovery vs. Leakage: The Math Problem

State Medicaid Fraud Control Units (MFCUs) — the primary enforcement arm — recovered approximately $1.4 billion in FY2024. They secured 1,151 criminal convictions and 741 civil settlements. The enforcement return is solid: for every $1 spent on MFCUs, $3.46 comes back in recoveries.

The $3.46-per-dollar return sounds impressive until you realize the scale of the problem. $1.4 billion recovered against $37.4 billion in improper payments means 96.3% of the money that shouldn't have gone out the door is never coming back.

To be fair, not all $37.4 billion is recoverable — much of it represents legitimate services with bad paperwork. But even conservative estimates of the true fraud rate (5–10% of total spending) suggest billions in actual theft that goes unrecovered every year.

23 Years on the GAO High-Risk List

The Government Accountability Office first placed Medicaid on its High-Risk List in 2003, citing “improper payments” and “program integrity” concerns. It has remained there every year since. The 2025 update kept it right where it's been for over two decades.

What has changed in 23 years? Total Medicaid spending roughly tripled. The improper payment rate has fluctuated between 5% and 12%, never sustainably dropping below 5%. New fraud schemes emerge faster than enforcement can adapt — from pill mills in the 2000s to COVID testing fraud in 2021 to home health billing schemes today.

GAO has issued hundreds of recommendations. CMS has implemented “corrective action plans.” States have upgraded their systems. And the error rate in FY2025 is higher than it was in FY2024.

What Our Data Shows

The PERM numbers measure the system's error rate. Our analysis of 227 million Medicaid billing records measures individual provider behavior. The two tell complementary stories.

In our data, 0.3% of providers account for 18% of all spending. The top 1,000 billers collected over $265 billion. Some of these are large health systems doing legitimate high-volume work. Others show patterns that don't look like paperwork errors — billing swings of 500%+ in a single year, cost-per-claim ratios 10x the national median, or appearing as a new provider and immediately billing tens of millions.

These aren't documentation gaps. They're behavioral anomalies that the PERM sampling methodology isn't designed to catch.

• View the watchlist → — 1,360+ providers flagged by 9 independent statistical tests
• ML fraud detection → — Random forest model trained on OIG-excluded providers, scoring 594K+ providers

The Path Forward

The traditional approach — sample claims after the fact, audit paperwork, publish an error rate — has had 23 years to prove itself. The error rate is going up.

What would actually work? The technology exists. Machine learning models can flag anomalous billing patterns in real time, before payments go out the door. Cross-database matching can catch excluded providers before they bill, not after. Behavioral analytics can identify the statistical fingerprints of fraud schemes as they emerge, not years later.

Some of these tools are being piloted. None are deployed at scale across all state Medicaid programs. The barriers aren't technical — they're bureaucratic, political, and financial. States run their own Medicaid programs with their own IT systems, and coordinating 50 different implementations of anything is slow.

Meanwhile, $37.4 billion went out the door improperly last year alone. The year before, it was $31.1 billion. The year before that, it was something else. The numbers change. The direction doesn't.

Read about our methodology →