The Deficit Reduction Act: What Medicaid Providers Need to Know About False-Claims Education

The Deficit Reduction Act of 2005, often shortened to the DRA, is a broad federal budget law. For health care organizations, one especially important provision is Section 6032, titled “Employee Education About False Claims Recovery.” It added Section 1902(a)(68) to the Social Security Act, now codified at 42 U.S.C. § 1396a(a)(68). ¹

This provision is meant to help prevent and detect fraud, waste, and abuse in Medicaid. It requires states to make certain high-volume Medicaid entities establish and distribute written information about false-claims laws, whistleblower protections, and the entity’s own procedures for identifying and preventing fraud. It is closely connected to the federal False Claims Act, but it does not create the same type of liability. The False Claims Act prohibits specified conduct involving government claims; the DRA provision creates an education-and-policy requirement for qualifying Medicaid entities.

Why Congress Added This Requirement

Medicaid pays a large number of claims through complex relationships among state agencies, health systems, managed-care organizations, professionals, facilities, suppliers, billing companies, and other contractors. People working within those systems are often the first to notice billing practices or records that do not match the services actually provided.

Section 6032 uses written policies and employee information as prevention tools. Its basic idea is that workers and relevant contractors should know what false claims are, how the organization prevents and detects them, where concerns can be reported, and what protections may apply when someone lawfully reports suspected wrongdoing.

Who Is Subject to Section 6032?

The statutory requirement applies to an entity that receives or makes annual payments under a state Medicaid plan totaling at least $5 million. The statute refers to payments under the state plan, and CMS guidance also addresses payments under Medicaid waivers and demonstrations. ^{1 2}

CMS explains that the threshold is evaluated using the federal fiscal year, which runs from October 1 through September 30. If an entity receives or makes at least $5 million in qualifying payments during that period, it must comply beginning January 1 of the following calendar year. The calculation is based on amounts actually received or made, not simply amounts billed. ²

The $5 million test can be more complicated than looking at one building, tax identification number, or provider number. CMS generally describes the entity as the largest separate organizational unit furnishing Medicaid health care items or services, together with its subunits that furnish those items or services. Corporate structure, health-system relationships, and operations can affect the analysis. Multiple locations or federal employer identification numbers do not automatically make each component a separate entity.

Payments from different states generally are not combined to reach the threshold. However, once the organization meets the threshold based on one state’s Medicaid payments, the required policies must reach all of the entity’s employees, including employees located in other states. Medicare payments ordinarily do not count, although certain Medicaid-paid deductibles or coinsurance for people who are dually eligible can count. ²

What Written Policies Are Required?

A qualifying entity must establish written policies for all of its employees, including management, and for employees of its contractors or agents who fall within the requirement. The policies must provide detailed information about:

• The federal False Claims Act, 31 U.S.C. §§ 3729–3733.
• Federal administrative remedies for false claims and statements.
• Applicable state civil or criminal laws concerning false claims and statements involving Medicaid.
• Whistleblower protections under federal and state law.
• The entity’s own policies and procedures for detecting and preventing fraud, waste, and abuse.

The statute also requires the written policies to include specific discussion of the laws’ role in preventing and detecting fraud, waste, and abuse in federal health care programs. A policy that merely says “employees must follow all laws” is unlikely to communicate the detailed information contemplated by the provision.

The Employee Handbook Requirement

If the entity has an employee handbook, that handbook must contain a specific discussion of the laws, employee rights to protection as whistleblowers, and the entity’s fraud-prevention and detection policies and procedures. ¹

CMS guidance explains that when an organization has separate handbooks for different employee groups, the required information belongs in each relevant handbook. When the same employees receive several handbooks, it may be placed in the handbook that addresses fraud, waste, and abuse policies. ²

The information may be provided on paper or electronically, but it must be readily available. Employees, contractors, and agents must be made aware that the policies exist and where to find them. Quietly placing a document on an internal drive without telling anyone may not accomplish meaningful dissemination.

Does the DRA Require Annual Training?

CMS has stated that Section 6032 itself does not impose a separate training requirement. In this provision, employee education means providing the required information to employees, contractors, and agents. ²

That distinction matters, but it should not be misunderstood. A state Medicaid agency, provider agreement, managed-care contract, corporate integrity agreement, accreditation standard, or the organization’s own compliance program may require formal training, acknowledgments, or annual refreshers. An organization may also reasonably decide that training is the most effective way to ensure people understand the policy. The point is only that the federal text of Section 6032 does not by itself prescribe a particular classroom, video, test, or annual training format.

Which Contractors and Agents Are Included?

The contractor requirement is broader than billing companies. CMS guidance includes contractors or agents that, on the entity’s behalf, furnish or authorize Medicaid health care items or services, perform billing or coding, or monitor health care provided by the entity. Depending on the relationship, this can include independent professionals, suppliers, managed-care contractors, and other vendors involved in Medicaid services. ²

Contractors performing functions unrelated to Medicaid health care services—such as some cafeteria, grounds-maintenance, copying, or shredding services—are generally outside CMS’s definition for this specific provision. The result depends on the contractor’s actual function and relationship, not simply the label in the contract.

CMS says Section 6032 does not require every contract to quote the statute. The entity must nevertheless disseminate the policies to applicable contractors and agents, who must make them available to relevant employees and abide by the policies as they relate to work for the entity. State oversight methods or contracts may add more specific requirements.

What Should the Policies Explain About the False Claims Act?

At a minimum, employees should understand that the federal False Claims Act can impose liability when a person knowingly submits or causes a false claim for government payment, uses a materially false record connected to a claim, conspires to violate the law, or knowingly avoids an obligation to repay the government. “Knowingly” includes actual knowledge, deliberate ignorance, and reckless disregard; a specific intent to defraud is not required. ³

Healthcare examples may include billing for services not provided, altering records to support payment, upcoding, billing medically unnecessary services, misrepresenting eligibility or compliance with a material payment condition, submitting claims tainted by certain kickbacks, or knowingly retaining an identified government overpayment instead of following the applicable reporting and repayment rules.

The policy should also explain lawful internal reporting routes, the role of the compliance officer or hotline, nonretaliation expectations, how reports are reviewed, and the importance of preserving records and telling the truth during an investigation.

Whistleblower Information Is Required

Section 6032 expressly requires information about federal and state protections for whistleblowers. Under the federal False Claims Act, qualifying employees, contractors, and agents may seek relief when they suffer discharge, demotion, suspension, threats, harassment, discrimination, or another adverse change in working conditions because of protected efforts to stop violations or protected conduct connected to a False Claims Act case. Possible relief can include reinstatement, double back pay, interest, special damages, and litigation costs and attorney fees. ⁴

The precise legal test depends on the conduct, the employer’s knowledge, the response, timing, and other facts. The DRA policy should not promise that every workplace complaint automatically qualifies for protection, but it should clearly communicate that retaliation is prohibited and concerns should be handled through a fair, confidential process to the extent possible.

Practical Compliance Steps

1. Determine whether the entity meets the threshold. Review qualifying Medicaid payments for each federal fiscal year and document the organizational-unit analysis.
2. Identify covered relationships. Map employees, management, contractors, agents, suppliers, billing functions, and monitoring roles connected to Medicaid health care items or services.
3. Compare federal, state, and contract requirements. The state’s Medicaid plan, manuals, enrollment agreements, and managed-care contracts may be more specific than the federal baseline.
4. Maintain detailed written policies. Address the required laws, whistleblower protections, reporting methods, investigations, overpayments, record preservation, nonretaliation, and fraud-prevention procedures.
5. Update employee handbooks. Make sure the discussion is included in every relevant handbook and remains accurate.
6. Disseminate and document. Record how and when policies were made available and how employees and contractors were told where to find them.
7. Keep reporting channels usable. Provide a realistic way to report concerns without forcing a worker to report only to someone who may be involved.
8. Review the program periodically. Update legal citations, contact information, contractor lists, reporting instructions, and state-law summaries.

Common Misunderstandings

“Only providers receiving federal grants are covered.”

The Section 6032 threshold concerns qualifying Medicaid payments, not whether an entity receives a discretionary federal grant.

“Only the billing department needs the policy.”

The statute requires policies for all employees of a qualifying entity, including management, as well as applicable contractor and agent employees.

“A policy posted online is automatically enough.”

Electronic distribution is allowed, but the policy must be readily available and people must be made aware of its existence and location.

“The federal DRA requires annual classroom training.”

CMS says Section 6032 requires dissemination of information, not a particular formal training program. Other authorities may separately require training.

“Meeting the DRA policy requirement prevents False Claims Act liability.”

A written policy is an important compliance measure, but it does not excuse false claims, ignored overpayments, retaliation, or failures to respond to credible information. Compliance must exist in practice, not only on paper.

The Main Point

Section 6032 of the Deficit Reduction Act makes false-claims education part of Medicaid program integrity. Qualifying entities must do more than tell workers to obey the law: they must provide detailed written information, include required material in employee handbooks, reach relevant contractors and agents, explain whistleblower protections, and describe how the organization detects and prevents fraud, waste, and abuse. A strong policy helps people recognize problems early, report them safely, and correct them before patients and public programs are harmed.