Health Law Daily Wrap Up, FRAUD AND ABUSE—OIG REPORTS: OIG White Paper suggests more must be done to combat fraud related to durable medical equipment, (Aug 27, 2026)

By Donielle Tigay Stutland, J.D.

One case involved fraudulently billing Medicare for over $10 billion in durable medical equipment, prosthetics, orthotics, and supplies.

The Department of Health and Human Services Office of Inspector General (OIG) released a White Paper detailing Medicare billing fraud related to durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS), such as wheelchairs, knee braces, and diabetic testing strips used to help Medicare enrollees to manage an illness or injury. In the paper titled, The Nation’s Challenge to Combat Durable Medical Equipment Fraud in Medicare, OIG concludes that DMEPOS fraud continues to cost Medicare and taxpayers millions of dollars each year despite existing safeguards (OIG Report, No. OEI-02-24-00311, August 17, 2026).

OIG reports that fraudsters continually come up with new schemes to evade CMS’s safeguards and commit fraud. The paper highlights one case in which international bad actors are accused of fraudulently billing Medicare for over $10 billion in DMEPOS. While CMS has recently taken a number of steps to strengthen its program integrity tools and increase its oversight of DMEPOS suppliers, OIG notes that more actions are needed. CMS works with partners through its new Fraud Defense Operations Center to more proactively identify suspect billing and suspend payments. CMS also imposed a 6-month nationwide moratorium on Medicare enrollment of new DMEPOS suppliers so that it could explore additional safeguards to address DMEPOS fraud. However, in order to adequately address this fraud, OIG indicates that it is imperative that CMS and others continue to their fraud-fighting efforts.

Key Highlights. In efforts to highlight actions that CMS and others can take to stop bad actors from exploiting Medicare, the white paper focuses on three key elements that bad actors need to commit DMEPOS fraud: 1. a Medicare-enrolled DMEPOS supplier, 2. a physician order for DMEPOS, and 3. a Medicare enrollee’s identification number.

OIG reports that despite safeguards, bad actors are still able to become Medicare-enrolled DMEPOS suppliers. OIG gives examples of how on-site inspections do not always prevent bad actors from enrolling in Medicare. When suppliers apply to enroll in Medicare, CMS conducts several screening checks, including on-site inspections. These inspections focus on whether suppliers meet specific standards—such as posting their hours and having a working business phone number. However, the timing of these on-site inspections can be predictable, allowing bad actors to temporarily stage their facilities to appear compliant. Additionally, while suppliers are required to purchase a surety bond, which is intended to deter fraud and ensure that CMS can recover overpayments, this has not kept bad actors from fraudulently billing Medicare.

The white paper also identifies that “straw owners” are used to evade oversight. CMS collects information about the owners of DMEPOS suppliers and conducts fingerprint-based background checks as a part of the enrollment process. However, bad actors sometimes hide the true owners by using straw owners—also known as nominee owners—which evades these checks. Additionally, unreported changes of ownership are difficult to detect. CMS requires that DMEPOS suppliers report changes in majority ownership. However, CMS does not have a single data source to verify ownership information or detect unreported changes of ownership.

The white paper also notes that paper enrollment applications can be used to circumvent identity checks. CMS allows DMEPOS suppliers to submit either paper or electronic enrollment applications. Bad actors can use paper applications to avoid certain identity checks that are required to access CMS’s online enrollment system. Additionally, paper applications can conceal the location of the applicant, making it more difficult to track bad actors. Finally, DMEPOS suppliers that bill only Medicare Advantage are not required to enroll in Medicare. As a result, these suppliers are not subject to CMS’s screening checks or other enrollment requirements and may pose an increased risk to the program.

Fraud examples. The paper also highlighted two examples of large scare fraud schemes. IA transnational criminal organization is accused of running a complex DMEPOS fraud scheme that billed Medicare for more than $10 billion.The group used straw owners to hide their true identities while buying dozens of DMEPOS suppliers that were already allowed to bill Medicare. Using stolen enrollee information, they then submitted huge volumes of false claims for medical equipment that was never ordered by physicians and never provided to patients. While CMS suspensions stopped most payments, the group still received about $941 million from Medicare and secondary payers and moved funds overseas.

In Operation Brace Yourself, bad actors lured Medicare enrollees into calling overseas call centers with ads for free braces and then pressured them into accepting multiple unnecessary items. The calls were passed to telemedicine physicians who ordered unneeded braces, and unscrupulous DMEPOS companies used those orders to bill Medicare. The bad actors used the proceeds from this fraud to purchase exotic automobiles, yachts, and luxury real estate

Recommendations. OIG offers recommendations to prevent fraud, specifically through ways to strengthen Medicare enrollment. OIG suggests that CMS, “block fraud at the front door by strengthening Medicare enrollment,” through various measures:

• Strengthen on-site inspections (tighter criteria; more thorough/frequent or unannounced visits for high-risk suppliers);

• Improve detection of unreported ownership changes and straw/nominee owners (better data-sharing with Treasury and others; AI on state ownership data; monitor bank-account/EFT changes);

• Ban paper enrollment applications (requiring electronic submission with identity checks);

• Increase oversight of newly enrolled suppliers and those with recent ownership changes;

• Reassess/update surety-bond requirements; and

• Require DMEPOS suppliers that bill only Medicare Advantage to enroll in Medicare;

• Consider need-based enrollment.

OIG’s paper also suggests ways to catch fake physician orders and claims to stop fueling fraud, such as:

• Engage ordering physicians;

• Harness new technologies and analytics, including AI to help reviewers detect AI-generated orders and documentation;

• Enhance and streamline payment suspensions;

• Expand medical reviews beyond education-focused “Targeted Probe and Educate”;

• Work with secondary payers so they can stop paying after CMS suspensions; and

• Require Medicare Advantage organizations to submit ordering-physician NPIs on encounter data.

Finally, OIG also stresses the need to stop the use of stolen enrollee identification numbers in order to shut down fraud. The paper notes additional actions are needed, such as:

• Discontinue or tightly restrict enrollee lookup tools;

• Seek statutory changes to prohibit all unsolicited contact by DMEPOS suppliers and associated marketers/call centers;

• Partner with social-media companies to stop sales of enrollee identifiers;

• Engage enrollees; and

• Change how Medicare protects identifiers, drawing on approaches from other industries (e.g., credit-card practices).

ReportsLetters: OIGReports CMSNews AuditNews DMENews FraudNews