Medicare Fraud, Waste & Abuse (FWA) Training: Requirements and Exemptions Explained

If your organisation touches Medicare Advantage or Part D business, there's a training requirement that's easy to overlook precisely because it sounds like something else you already do: Fraud, Waste, and Abuse (FWA) training. It's a distinct, federally mandated annual requirement with its own deadline, its own audience, and its own exemption rules — and getting the exemption wrong is one of the more common compliance gaps CMS auditors find.

What FWA training actually covers

FWA training teaches staff to recognise and report the three related but distinct categories: fraud (intentional deception for financial gain, such as billing for services never rendered), waste (overutilisation that isn't intentional but still costs the programme money), and abuse (practices inconsistent with accepted business or medical practices, like upcoding or unnecessary services). It also covers common red flags and, critically, how staff should escalate a concern once they spot one.

Who has to take it, and by when

Any organisation with employees, temporary workers, volunteers, contractors, or governing body members who touch Medicare Parts C and D compliance activities has to ensure FWA training is completed. The standard rule: within 90 days of hire or contracting, then repeated at least annually — most organisations run it on a calendar-year cycle with a 31 December deadline.

The exemption that trips people up

Providers already enrolled in Medicare Part A or B are generally deemed to have met the FWA training requirement, on the theory that the enrollment screening process already covers similar ground. But this exemption is narrower than it sounds, in two specific ways:

• It applies only to FWA training — the separate General Compliance Training requirement still has to be completed regardless of Medicare A/B enrollment status.
• It applies to enrolled providers, not to every entity touching the business. Administrative vendors — pharmacy benefit managers, call centres, IT firms — that aren't themselves enrolled in Medicare still have to complete FWA training even if they contract with an enrolled organisation.

Plan sponsors are entitled to request proof of enrollment status before relying on the deemed exemption for any given contractor, and getting this wrong — assuming an exemption applies to a vendor that isn't actually enrolled — is a documented, recurring finding in CMS compliance program audits.

What non-compliance actually risks

Because FWA training sits inside the broader Medicare Parts C and D compliance programme requirements, gaps here don't stay contained to a training checkbox. Consequences tied to fraud, waste, and abuse programme failures include overpayment recovery, civil monetary penalties, exclusion from federal healthcare programmes, and contract actions against the plan sponsor relationship itself — the same enforcement machinery covered in Learnsignal's Medicare risk adjustment compliance piece, since FWA and risk-adjustment-coding fraud are both prosecuted as fraud against the same federal programme.

Building FWA training into a broader compliance calendar

Because FWA training runs on an annual cycle with a hard deadline, it works best tracked alongside — not folded into — general compliance training, since the two have different scope, different completion windows, and different exemption rules. A simple, durable process: maintain a current roster of everyone who touches Medicare Parts C/D activity (including contractors and vendors), track enrollment status separately for each entity claiming the deemed exemption, and set the annual deadline as a fixed calendar date rather than "within a year of last time," which tends to drift.

This discipline mirrors the fraud-and-abuse landscape covered in Learnsignal's Stark Law and Anti-Kickback Statute training — FWA, Stark, and Anti-Kickback all sit under the same federal fraud-prevention umbrella, even though each has its own specific training and reporting requirements.

What good FWA documentation looks like at audit time

CMS compliance program audits don't just check whether training happened — they check whether the organisation can prove it, for the right population, on the right cycle. A defensible FWA training record typically includes: a dated completion certificate or attestation for every individual in scope, a record of who was excluded under the deemed-exemption rule and the enrollment documentation that justified it, and evidence the 90-day new-hire window was actually met rather than approximated. Auditors have specifically flagged organisations that could show training completion but couldn't produce the underlying enrollment proof for a deemed-exempt vendor — the exemption claim itself needs to be documented, not just asserted.

A second common gap is treating FWA training as a one-time onboarding item rather than a genuinely annual requirement. Because the content rarely changes dramatically year to year, it's tempting to treat a prior year's completion as "close enough." CMS doesn't see it that way, and neither should an internal audit checklist — each calendar year needs its own completed, dated record for every person in scope.

Frequently asked questions

Does completing FWA training once cover multiple years?
No. It's an annual requirement with its own deadline each year, separate from onboarding training completed at hire.

If a provider is deemed exempt from FWA training, do they still need General Compliance Training?
Yes. The Medicare A/B enrollment exemption applies only to the FWA training requirement, not to General Compliance Training, which every relevant individual still has to complete.

Who's responsible for verifying a vendor's claimed exemption?
The plan sponsor. Requesting proof of Medicare enrollment status before accepting a vendor's claim of deemed-exempt status is standard due diligence, not an optional extra step.

FWA training is a small, specific requirement that's easy to get administratively wrong even with good intentions. Learnsignal's CPD training library covers Medicare compliance training, including fraud, waste, and abuse requirements for healthcare organisations and their contracted partners.