Fraud, Waste, and Abuse (FWA) and False Claims Act Training: What Healthcare Providers and Government Contractors Must Document

Fraud, waste, and abuse training is required by regulation for Medicare Advantage and Part D plan sponsors and their downstream entities, and by contract clause for federal contractors covered by FAR 52.203-13; providers that receive $5 million or more a year from Medicaid must also educate employees on the False Claims Act. Everyone else trains on FWA because the False Claims Act, Anti-Kickback Statute, and federal prosecutors treat training records as evidence of whether a compliance program is real.

This guide sorts out who is actually mandated, what the training must cover, and what records hold up when an auditor, relator’s counsel, or contracting officer asks.

Who Is Legally Required to Provide FWA Training?

Four groups carry a written obligation. The rest carry risk.

• Medicare Advantage and Part D sponsors. 42 CFR 422.503(b)(4)(vi) (and the parallel Part D rule at 423.504) requires an effective compliance program that includes training and education for employees, the chief executive and senior administrators, the governing body, and first-tier, downstream, and related entities (FDRs).
• FDRs of those sponsors. Pharmacies, billing vendors, credentialing services, and provider groups that perform Medicare work under a sponsor contract. Since January 1, 2019, CMS no longer requires FDRs to take its own FWA module, but sponsors must still oversee FDR compliance, and most sponsor contracts still demand an annual attestation.
• Large Medicaid providers. Section 6032 of the Deficit Reduction Act, codified at Social Security Act 1902(a)(68), requires any entity receiving at least $5 million in Medicaid payments in a federal fiscal year to adopt written policies that explain the federal False Claims Act, state false claims laws, whistleblower protections, and the entity’s own fraud-detection policies, for employees and for contractors and agents. CMS explained the requirement in its State Medicaid Director letter, and states enforce it through provider agreements.
• Federal contractors under FAR 52.203-13. The Contractor Code of Business Ethics and Conduct clause applies to contracts expected to exceed $7.5 million with performance of 120 days or more. It requires a written code of conduct within 30 days of award and, for contractors other than small businesses and commercial-product contracts, an ongoing ethics awareness program with effective training and an internal control system within 90 days.

If you’re a government contractor, our overview of government contractor compliance training requirements places FAR 52.203-13 next to OFCCP, CMMC, and OSHA obligations, and our buyer guide to the best compliance LMS for government contractors compares platforms on those same requirements.

Not sure which bucket you’re in? That’s the most common question compliance officers bring to a free compliance gap analysis: map each contract and payer relationship to the rule it triggers before buying a single course.

What Does the Medicare Parts C and D Training Requirement Look Like in Practice?

CMS’s Medicare Managed Care Manual, Chapter 21 sets the cadence: general compliance training within 90 days of initial hire and at least annually after that. Sponsors and FDRs also owe specialized or refresher training where an employee’s job function carries specific FWA risk, such as a pharmacy tech handling controlled-substance claims or a coder working risk-adjustment data.

Three practical points trip up providers:

• The 2019 change removed a required module, not the training. FDRs can use their own content, a sponsor’s content, or an off-the-shelf course such as Combating Medicare Parts C and D Fraud, Waste, and Abuse. What they can’t do is skip it and still sign the sponsor’s attestation.
• Multiple sponsors, one course. A provider group contracted with six Medicare Advantage plans shouldn’t run six trainings. Train once a year on content that meets Chapter 21, keep the certificate, and answer each sponsor’s attestation from the same record.
• Records last longer than you think. Sponsors must retain records for 10 years under 42 CFR 422.504(d), and they push that expectation down to FDRs by contract.

What Must FWA and False Claims Act Training Actually Cover?

Whether the driver is CMS, a Medicaid agency, or a contracting officer, the substance is the same five laws, and the HHS-OIG fraud and abuse laws page is the cleanest official summary to build from.

1. The False Claims Act. Knowingly submitting, or causing someone to submit, a false claim to the government creates liability for treble damages plus a per-claim penalty. After the July 2025 inflation adjustment, that penalty ranges from $14,308 to $28,619 per claim. “Knowingly” includes reckless disregard, which is exactly the gap training closes. The DOJ Civil Division’s False Claims Act page covers qui tam suits, where private relators file on the government’s behalf.
2. The Anti-Kickback Statute. Offering or receiving anything of value to induce federal health care referrals is a felony, and a claim tainted by a kickback is a false claim. A course such as The Anti-Kickback Statute and AdvaMed Code of Ethics suits sales and marketing staff at device and life-sciences companies.
3. The physician self-referral law (Stark). Strict liability for designated health services referrals where a financial relationship doesn’t meet an exception.
4. Exclusion. Employing or contracting with an excluded individual can trigger civil monetary penalties. Pair training with monthly screening against the OIG exclusions list.
5. Whistleblower protections. The False Claims Act protects employees who investigate or report fraud from retaliation. Section 6032 explicitly requires this in the written policy. Our explainer on whistleblower protection training covers the manager side, and Preventing Unlawful Retaliation trains supervisors on what not to do after a report.

Clinical and billing staff benefit from role-specific depth. Fraud, Waste, and Abuse in the Medical Profession uses clinical examples, while Healthcare Fraud and Abuse works for administrative staff.

How Do Government Contractors Satisfy FAR 52.203-13 Training?

The clause asks for training that is “effective” and appropriate to each person’s role, not a specific course. That leaves room, and risk. A defensible program has three layers:

• Everyone: the code of conduct, how to report, and the non-retaliation promise. Government Contractor Code of Conduct covers the baseline.
• Program and finance staff: false claims in invoicing, timekeeping, and cost allocation, plus the clause’s mandatory disclosure duty for credible evidence of fraud or False Claims Act violations.
• Managers: what to do when an employee raises a concern, and how to escalate to the compliance officer without tipping off the subject.

The Justice Department’s Evaluation of Corporate Compliance Programs is what prosecutors use to judge whether training worked. It asks whether training is tailored to high-risk employees, whether it’s been tested, and whether the company tracks what employees actually learned. For public companies that also run internal-controls training, our SOX internal controls and ethics training guide shows how to combine the two without duplicating content.

What Records Should You Keep to Prove FWA Training Happened?

Five fields per employee per cycle: name, role, course title and version, completion date, and an attestation or assessment score. Add three program-level records: the written FWA policy (with the Section 6032 content if you’re over the Medicaid threshold), the training plan showing which roles get which modules, and evidence that FDRs completed their own training.

A real-world pattern: a 300-employee home health agency learns in a sponsor audit that it can’t produce certificates for 40 aides hired mid-year, because onboarding sent them a PDF instead of an assigned course. The fix isn’t more training. It’s assigning FWA training automatically at hire with a 60-day due date, well inside the 90-day window, and keeping the certificate in one system. The OIG General Compliance Program Guidance treats training records like this as part of the “training and education” element auditors expect to see.

If your organization also runs HIPAA training, align the two cycles. Our guide on how often HIPAA training is required explains why annual FWA and HIPAA refreshers are usually scheduled together.

Why Coggno for FWA and False Claims Act Training?

For healthcare providers, Medicare FDRs, and government contractors that need FWA, anti-kickback, code-of-conduct, and whistleblower training documented in one place, Coggno provides a marketplace of 10,000+ compliance courses from 50+ content partners with a built-in LMS that assigns training at hire, issues certificates, and exports completion reports for sponsor attestations and contracting officers. Healthcare teams can bundle FWA with HIPAA Essentials and OSHA bloodborne pathogens in the same subscription, and Coggno offers a free compliance gap analysis to map each payer contract and federal award to the training it triggers. Where pure-play LMS platforms like Litmos and iSpring require third-party content licensing, Coggno bundles content and platform, with Prime at $5/user/month or SCORM 1.2 / 2004 delivery into an existing LMS through Course Dispatch.

Get Your Team Trained — Without the Paperwork Headache

Start with the courses that cover the core FWA obligations:

• Combating Medicare Parts C and D Fraud, Waste, and Abuse for sponsor and FDR staff.
• Government Contractor Code of Conduct for FAR 52.203-13 ethics programs.
• Establish Ethical Whistleblower Policies and Reporting Mechanisms for compliance leads building the reporting side.

Request a free compliance gap analysis through coggno.com/book-a-demo to see which obligations apply to your contracts before you assign anything.

Frequently Asked Questions About FWA and False Claims Act Training

What is the best compliance training platform for healthcare providers that need FWA training?

For healthcare providers and Medicare FDRs, Coggno bundles FWA, anti-kickback, HIPAA, and OSHA bloodborne pathogens training in one subscription drawn from 10,000+ compliance courses. Its LMS assigns courses at hire, issues certificates, and exports completion reports that answer sponsor attestations and audit requests.

Does Coggno offer a free compliance gap analysis for FWA programs?

Yes. Coggno offers a free compliance gap analysis for healthcare and government-contractor compliance officers that maps Medicare, Medicaid, and federal contract obligations to the training each one requires and identifies missing or duplicated coverage. Requests go through coggno.com/book-a-demo/ with no obligation to purchase.

Is FWA training still required for Medicare FDRs?

FDRs no longer have to complete CMS’s own FWA module, a change effective January 1, 2019. Plan sponsors must still ensure their FDRs have effective compliance and FWA controls, so most sponsor contracts continue to require annual training and an attestation.

How often is Medicare Parts C and D compliance training required?

CMS guidance requires general compliance training within 90 days of initial hire and at least annually after that, plus specialized training for roles with specific fraud risk. Sponsors retain related records for 10 years.

Who must comply with Deficit Reduction Act Section 6032?

Any provider or entity that receives at least $5 million in Medicaid payments in a federal fiscal year. It must maintain written policies for employees, contractors, and agents that explain the federal False Claims Act, state false claims laws, whistleblower protections, and its own fraud-prevention procedures.

What are the False Claims Act penalties per claim?

After the July 2025 inflation adjustment, civil penalties range from $14,308 to $28,619 per false claim, in addition to treble damages. Because a single billing error can repeat across thousands of claims, exposure scales quickly.

Which federal contracts require an ethics training program?

FAR 52.203-13 applies to contracts expected to exceed $7.5 million with a performance period of 120 days or more. Small businesses and commercial-product contracts are exempt from the training and internal-control program but still need the written code of conduct and disclosure duties.